Poisoned Pipeline / Techniques / T0140
Harvest tokens from environment variables
This type of attack involves searching for environment variables that may contain sensitive information and dumping their values to gain access to the associated resources.
In cloud and container environments, environment variables are often used to store configuration data, including sensitive information such as passwords, tokens and API keys.
Attackers can exploit this by searching through the environment variables of running containers or cloud instances to find any sensitive information that has been inadvertently exposed.
Once the sensitive information has been obtained, attackers can use it to access and compromise the associated resources.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
- https://www.trendmicro.com/en_ie/research/22/h/analyzing-hidden-danger-of-environment-variables-for-keeping-secrets.html
- https://developer.hashicorp.com/vault/docs/what-is-vault
Mitigations
- M1120 Store credentials in vault
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (39)
- mrmustard 0.7.4 PyPI credential stealer via stolen publish token
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
- @subql/common 5.8.3 published after a CI artifact swap
- codfish/semantic-release-action tag hijack (Miasma)
- Team PCP CI/CD secrets campaign
- tw-pkgprobe-7731 npm campaign targeted Twilio developers
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- TeamPCP DUSTMAKER AI workspace poisoning
- jscrambler@8.14.0 preinstall native binaries
- Spoofed Dependabot commits and secret-stealing Actions
- Malicious Maven package exfiltrates OAuth credentials
- PyTorch-nightly torchtriton dependency confusion
- tj-actions/changed-files GitHub Action
- Nx s1ngularity (stolen npm token via Actions injection)
- pino-sdk-v2 Discord webhook env stealer
- Keyv / Cacheable ChainDrop worm
- PhantomRaven hidden HTTP npm dependencies
- @7nohe/openapi-react-query-codegen poisoned publish workflow
- Hades .pth and AI-assistant config persistence
- Railway build-infrastructure access decrypted a subset of customer environment variables
- eslint-scope and eslint-config-eslint malicious publishes
- Codecov Breach
- Compromised Injective SDK on npm
- Coder registry CDN origin pool compromise
- Shai-Hulud first wave (@ctrl/tinycolor)
- Dependency confusion (Alex Birsan)
- LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
- npm-global-util preinstall credential theft
- hackerbot-claw autonomous GitHub Actions exploitation
- sckit worm in MemTensor npm plugin and PyPI MemoryOS
- sckit worm in MemTensor npm plugin and PyPI MemoryOS
- TanStack Mini Shai-Hulud (CVE-2026-45321)
- Megalodon mass GitHub repo backdooring via CI
- Claude eval agent published a malicious package to live PyPI
- CNCF Antrea Jenkins slash-command credential theft
- prt-scan 219 malicious PRs stealing CI secrets