Configuration values are stored in .env.development and referenced in application.properties.
A new Shai-Hulud npm strain and a fake Jackson Maven package show how attackers abuse trusted dependencies to steal secrets ...