Poisoned Pipeline / Techniques / T0193
Sensitive information in environment variables
Cloud Security CI/CD Posture
Environment variables are a type of configuration parameter that contain information about the environment in which an application is running.
These variables can be set and accessed by the operating system or application, and may contain sensitive information such as passwords, API keys, or other credentials.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1120 Store credentials in vault
- M1930 Avoid storing sensitive information in environment variables
- M1931 Use a secure secrets management system
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1930 Regularly review and audit environment variables
Observed in incidents (8)
- actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
- Team PCP CI/CD secrets campaign
- tw-pkgprobe-7731 npm campaign targeted Twilio developers
- tj-actions/changed-files GitHub Action
- PhantomRaven hidden HTTP npm dependencies
- Miri writes env secrets into target/ readable from PR caches
- sckit worm in MemTensor npm plugin and PyPI MemoryOS
- TanStack Mini Shai-Hulud (CVE-2026-45321)