criticalsuspicious.env_credential_accessLocationscripts/openproject.mjs:28FindingEnvironment variable access combined with network send.