T1552

Unsecured Credentials

discovered 2026-07-07

DependencyInjector.Core harvests every process environment variable (name+value), categorized by cloud-provider prefix (AWS_/AZURE_/GOOGLE_/GCP_/KUBERNETES_/HEROKU_/RAILWAY_/FLY_/VERCEL_/RENDER_/DIGITALOCEAN_/ASPNETCORE_ etc.).

View on MITRE ATT&CK

Seen in packages

npm paysafe-checkoutuses
pypi paysafe-sdkuses
nuget DependencyInjector.Coreuses
npm @injectivelabs/sdk-tsuses