<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
My malware checker has identified potential malware (AtomicStealer)
distributed from MacPorts. I'd like to confirm with the community
what else is known:<br>
<br>
<br>
<blockquote>/Applications/MacPorts/tea.app<br>
➜ /Applications cd MacPorts<br>
<br>
➜ MacPorts ls<br>
pinentry-mac.app Python 3.10 Python 3.11 Python
3.12 Python 3.13 tea.app<br>
<br>
drwxr-xr-x@ 3 root wheel 96B Nov 24 20:52 pinentry-mac.app<br>
drwxr-xr-x@ 4 root admin 128B Dec 8 01:21 Python 3.10<br>
drwxr-xr-x@ 4 root admin 128B Dec 8 01:25 Python 3.11<br>
drwxr-xr-x@ 4 root admin 128B Feb 8 21:06 Python 3.12<br>
drwxr-xr-x@ 4 root admin 128B Feb 8 21:08 Python 3.13<br>
drwxr-xr-x@ 3 root admin 96B Mar 21 22:01 tea.app<br>
<br>
➜ MacPorts find tea.app<br>
tea.app<br>
tea.app/Contents<br>
tea.app/Contents/MacOS<br>
tea.app/Contents/MacOS/tea<br>
tea.app/Contents/Resources<br>
tea.app/Contents/Resources/empty.lproj<br>
tea.app/Contents/Info.plist<br>
tea.app/Contents/PkgInfo<br>
</blockquote>
<br>
<br>
<br>
Thanks,<br>
<br>
Forrest<br>
<br>
</body>
</html>