T1552

Unsecured Credentials

discovered 2026-05-02

DependencyInjector.Core harvests every process environment variable (name+value), categorized by cloud-provider prefix (AWS_/AZURE_/GOOGLE_/GCP_/KUBERNETES_/HEROKU_/RAILWAY_/FLY_/VERCEL_/RENDER_/DIGITALOCEAN_/ASPNETCORE_ etc.).

View on MITRE ATT&CK

Seen in packages

rubygems knot-activesupport-loggeruses
npm paysafe-checkoutuses
pypi paysafe-sdkuses
nuget DependencyInjector.Coreuses
npm @injectivelabs/sdk-tsuses

Campaigns

SleeperGemattributed-to