Wiz Previews Workstation Sensor to Detect Developer Supply-Chain Threats
Summary
Wiz announced a private-preview sensor for Windows and macOS developer workstations that inventories packages and AI tools, detects suspicious activity, maps exposed credentials to reachable resources, and supports response.
Key points
- The sensor is in private preview for Windows and macOS and deploys through existing mobile device management solutions.
- It inventories packages, secrets, IDE extensions, AI coding agents, MCP servers, and other AI components across developer workstations.
- It alerts on known malicious packages and suspicious behavior, including unexpected processes, credential-file scanning, and anomalous outbound connections.
- Wiz says its Blue Agent can analyze detected threats, summarize attack chains, and recommend response actions.
- The sensor and Wiz Security Graph can show which repositories, cloud environments, or resources discovered workstation secrets could access.
- Response options include terminating malicious processes, collecting forensic artifacts, and rotating exposed credentials or revoking compromised tokens.
Article Details
- Event Type
- Wiz announced the Wiz Sensor for Developer Workstations, a security product for Windows and macOS, in Private Preview.
- Impact
- The Sensor is intended to provide continuous visibility into developer workstation packages, secrets, IDE extensions, AI tools, and MCP servers; detect and respond to supply-chain threats; and help teams assess exposed credentials and enforce AI-use policies. The article also reports that the Shai-Hulud, Axios, and s1ngularity attacks targeted developer workstations. It states that s1ngularity exposed over 1,000 GitHub tokens and that stolen credentials exposed 5,500 private repositories.
Malware
Vendors
Products
Claudecredentials from developer workstations, then weaponized AI CLI tools already on the machine, including Claude and Gemini, to exfiltrate filesystem contents.Geminifrom developer workstations, then weaponized AI CLI tools already on the machine, including Claude and Gemini, to exfiltrate filesystem contents.macOSToday, Wiz is announcing the Wiz Sensor for Developer Workstations on Windows and macOS in Private Preview. The Sensor gives security teams continuous visibility into every package, IDE extension, and AI tool runningMicrosoft WindowsToday, Wiz is announcing the Wiz Sensor for Developer Workstations on Windows and macOS in Private Preview. The Sensor gives security teams continuous visibility into every package, IDE extension, and AI tool runningnpmDevelopers hold cloud credentials, npm publish tokens, and direct access to source code, and their work requires installing packages and running third-party code on their workstations. AI coding agents now do the sameNxs1ngularity compromised multiple versions of the Nx build system and its VS Code extension.VS Codes1ngularity compromised multiple versions of the Nx build system and its VS Code extension.Wiz Defend Threatssecurity teams get an alert the moment it lands on the workstation. Every detection feeds back into Wiz Defend Threats, continuously enriching the threat context that connects workstation detections to cloudWiz Reputation Databaseleading intelligence providers. Once a package is identified as malicious, it’s added to the Wiz Reputation Database within minutes. When a developer or AI agent installs a known malicious package, security teamsWiz Security GraphFor the first time, the Wiz Sensor brings developer workstations into the Wiz Security Graph. Deploying via existing MDM solutions, the Sensor gives security teams continuous visibility across the developer fleet,Wiz Sensor for Developer WorkstationsToday, Wiz is announcing the Wiz Sensor for Developer Workstations on Windows and macOS in Private Preview. The Sensor gives security teams continuous visibility into every package, IDE extension, and AI tool runningWiz WorkflowsAI tools are approved, flag unwanted tools like unauthorized MCP servers or coding agents, and use Wiz Workflows to automatically notify engineers when policy is violated.