StepSecurity Launches Malicious-File Scanning for GitHub and Developer Machines

Summary

StepSecurity launched a beta GitHub scanner for campaign-planted files across repository history and renamed its Dev Machine Guard feature Malicious Files, adding rule management and device-level findings.

Key points

Malicious Files for GitHub is in beta and scans repository history across branches, pull requests and tags against StepSecurity-maintained detection rules.
Rules combine filename and content checks; findings show where files appear, the introducing commit and account, matched checks, and file versions.
GitHub findings can be filtered and exported; findings are retained for 180 days after the file vanishes from all tracked refs.
Dev Machine Guard’s Suspicious Files feature is now Malicious Files, with controls to deactivate or reactivate rules and device-level findings.
The features target planted files in editor and AI-agent configurations, modified code and GitHub Actions workflows, including files associated with Miasma, ForceMemo, Megalodon and GhostAction.
StepSecurity recommends removing flagged files from every repository ref and device, then rotating credentials for the pushing account and affected machines.

Article Details

Event Type: Security product feature launch
Impact: StepSecurity launched Malicious Files for GitHub in beta and renamed Dev Machine Guard’s Suspicious Files feature to Malicious Files. The features scan repository history and enrolled developer devices for files associated with known campaigns, helping security teams locate findings across branches, pull requests, tags, and machines and support cleanup and credential rotation.

Malware

MiasmaEditor and AI agent configuration: in June, the Miasma worm used a compromised contributor account to push a commit into a Microsoft repository. The commit changed no source code. It added five files, including a

Vendors

StepSecurityToday StepSecurity is launching Malicious Files for GitHub (Beta), which scans the full history of every repository in your GitHub organization, across every branch, pull request and tag, for files planted by known

Products

Claude Codetask, that run a credential-harvesting payload the moment a developer opens the repository in Claude Code, Gemini CLI, Cursor or VS Code. The commit carried a [skip ci] flag and a timestamp backdated six years.Cursora credential-harvesting payload the moment a developer opens the repository in Claude Code, Gemini CLI, Cursor or VS Code. The commit carried a [skip ci] flag and a timestamp backdated six years.Dev Machine Guardacross every branch, pull request and tag, for files planted by known campaigns. At the same time, Dev Machine Guard's Suspicious Files feature becomes Malicious Files, with a new Rules page that lets you see,Gemini CLIthat run a credential-harvesting payload the moment a developer opens the repository in Claude Code, Gemini CLI, Cursor or VS Code. The commit carried a [skip ci] flag and a timestamp backdated six years.GitHubToday StepSecurity is launching Malicious Files for GitHub (Beta), which scans the full history of every repository in your GitHub organization, across every branch, pull request and tag, for files planted by known GitHub ActionsInjected workflows: Megalodon pushed backdoored GitHub Actions workflows into more than 5,500 repositories in six hours, and GhostAction disguised secret-stealing workflows as security improvements across 817 Malicious Files for GitHubToday StepSecurity is launching Malicious Files for GitHub (Beta), which scans the full history of every repository in your GitHub organization, across every branch, pull request and tag, for files planted by known VS Codepayload the moment a developer opens the repository in Claude Code, Gemini CLI, Cursor or VS Code. The commit carried a [skip ci] flag and a timestamp backdated six years.