CI runner shell curl POSTing env|base64 output over HTTP

ills3c Intel&Coffee@Ills3C

•updated yesterday•12•0•53

Detects suspicious curl commands spawned from shell processes on CI runners (such as GitHub Actions) that encode and POST environment variables using command substitution.