Architecture

Process Injection Architecture

1. muth.lock payload parsed.
2. RAM buffer decrypted using X25519 identity key.
3. Decrypted secrets formatted as KEY=VALUE strings.
4. Appended directly to exec.Command.Env.
5. Child process invoked with inherited parent os.Environ() + decrypted secrets.