Developer Workstations Emerge as Software Supply Chain Targets
Summary
The article reports campaigns targeting secrets in developer environments and CI/CD across npm, PyPI and Docker Hub, and argues that workstations should be treated as a local software supply chain boundary.
Key points
- The article reports that three campaigns targeting npm, PyPI and Docker Hub sought secrets from developer environments and CI/CD within a 48-hour window.
- It describes TeamPCP as using compromised packages and developer tooling to collect tokens, cloud credentials, SSH keys and environment data.
- It says Shai-Hulud campaigns turned infected developer environments into credential collection points; Shai-Hulud 2.0 exposed GitHub credentials among the collected credentials.
- Workstations can bring repositories, credentials, build scripts, package manager configurations and cloud profiles together, potentially exposing software delivery systems.
- Automation, dependency workflows and AI coding tools can move sensitive context or changes across systems quickly, increasing the potential impact of compromised developer environments.
- The article recommends assessing credential access and lifetime, detecting sensitive data before it spreads, and enabling rapid revocation and rotation.
Article Details
- Topic
- Developer workstations and CI/CD environments as software supply-chain attack surfaces for credential theft