Step Security Adds Developer Credential Inventory to Dev Machine Guard
Summary
Step Security says Dev Machine Guard now inventories credential sources across developer fleets, reporting device coverage and plaintext or protected status. The feature covers 13 source types; it does not validate whether credentials are active.
Key points
- The new Credentials page aggregates credential sources across a fleet and reports affected devices, plaintext devices, files, and credential entries.
- The inventory covers 13 source types across cloud, source control, package registries, containers, and infrastructure, but excludes locations such as keychains, environment variables, browser stores, and password managers.
- Step Security says credential files are read locally and that credential values, fragments, hashes, fingerprints, and parser output are not stored or sent off-device.
- Counts reflect the most recent device scan; entries are not deduplicated across devices or validated as active credentials.
- The article identifies SSH private keys as a source where passphrase protection can be assessed, and says the inventory can help scope credential rotation after a suspected theft.
- The feature is included from agent v1.16.0; macOS devices may need Full Disk Access granted to the agent for complete results.
Article Details
- Event Type
- Security product feature announcement: StepSecurity added a credential-source inventory page to Dev Machine Guard.
- Impact
- The feature helps security teams identify which developer machines contain supported credential sources and whether the material is plaintext or protected, aiding incident scoping and rotation planning. The article describes credential theft from developer machines and stolen tokens enabling further compromised package distribution. The inventory records source locations and counts, not credential values, and covers 13 source types with stated limitations.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe article describes a credential stealer planted in a PyPI package and a hijacked Bitwarden CLI package on npm.T1552.001 · Credentials In FilesThe article describes credential-stealing packages reading credentials from known local files, including configuration and token files.
Vendors
Products
Bitwarden CLIThat target list is not one actor's research. The hijacked Bitwarden CLI package on npm reached for nearly the same set, adding ~/.ssh/id_rsa, id_ed25519, id_ecdsa, and ~/.git-credentials, then weaponized any GitHubDev Machine GuardDev Machine Guard now inventories the credential sources in use across developer machines. A new Credentials page in the StepSecurity dashboard shows which credential sources are in use, how far each one spreads across