Injected Code — Environment-Variable Exfiltration - ATR-2026-01892 (b3628353-f854-5862-8bee-beb149ccf007)
Detects injected code that reads process environment variables via subscript access (os.environ[...]) and POSTs them to a remote server. Environment variables routinely hold API keys, tokens and paths, so this is a direct secret-exfiltration vector. Distinguished from benign os.environ.get() reads by requiring the remote POST sink.