StepSecurity Details H1 2026 Supply-Chain Security Product Releases

Jul 24, 2026 · Original article ↗

Summary

StepSecurity says it shipped pipeline protections in H1 2026, including Harden-Runner for macOS and Windows, Secure Registry cooldowns, device policies and GitHub Actions secret-exfiltration controls. It also cites its reporting on recent supply-chain attacks.

Key points

StepSecurity says it shipped its H1 roadmap, including Harden-Runner support for macOS and Windows alongside Linux, and Dev Machine Guard for all three operating systems.
The company describes Secure Registry as a cooldown proxy for package downloads, intended to keep newly published versions out of CI/CD builds and developer machines.
Dev Machine Guard covers IDE extensions, npm and Python packages, AI coding agents and MCP servers; Device Policy adds fleet-wide VS Code extension allow-listing.
StepSecurity says Secret Exfiltration Protection blocks GitHub Actions workflows planted to steal repository secrets; it also lists egress-blocking and workflow-run policies.
The company says its platform can search developer machines and repositories for compromised components and automatically cancel workflow runs that reference them.
StepSecurity says it discovered or was among the first to report supply-chain incidents including the Axios npm compromise, Shai-Hulud targeting TanStack, the Nx Console VS Code extension compromise, and compromises involving durabletask on PyPI and Red Hat cloud services npm packages.

Article Details

Event Type: StepSecurity's H1 2026 business and product update, including reports of software supply chain attacks identified by its research team.
Impact: StepSecurity reports accelerated revenue growth, roughly seven times as many new customers as in H1 2025, and the release of new pipeline-security capabilities. It says its team discovered or was among the first to publicly report several significant supply chain incidents, including compromises involving Axios, TanStack, Nx Console, durabletask, and Red Hat cloud services. The article says the Nx Console incident led to a breach of roughly 3,800 GitHub internal repositories, citing GitHub's disclosure as documented by CISA.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe article describes multiple software supply chain compromises, including attacks involving npm and PyPI packages and a VS Code extension.

Vendors

GitHubGitHub ChecksSecret Exfiltration ProtectionPackage Search: PRs + default branch Microsoftthe breach of roughly 3,800 GitHub internal repositories (per GitHub's disclosure, documented by CISA), Microsoft's durabletask PyPI compromise, and the Red Hat cloud services npm compromises. That research feeds Red Hat(per GitHub's disclosure, documented by CISA), Microsoft's durabletask PyPI compromise, and the Red Hat cloud services npm compromises. That research feeds straight into the platform: discovery becomes StepSecuritySix months ago, in our 2025 year-in-review, we shared that StepSecurity had grown ARR more than 5x for the second consecutive year, repeating the milestone we first announced in our 2024 year-in-review. We also

Products

Axiosamong the first to publicly report, many of the most consequential supply chain attacks of the year: the Axios npm compromise, the Shai-Hulud attack on TanStack, the Nx Console VS Code extension compromise that led to Dev Machine GuardDev Machine Guard, all three operating systemsIDE extensions, npm and Python packages, AI coding agents, MCP servers Device Policyand Secure Registry keep freshly published versions out of builds and off developer machines, Device Policy locks down what runs on engineering laptops, workflow policies and egress block mode stop malicious DurableTaskroughly 3,800 GitHub internal repositories (per GitHub's disclosure, documented by CISA), Microsoft's durabletask PyPI compromise, and the Red Hat cloud services npm compromises. That research feeds straight into the Harden-Runneryear-in-review. We also committed to an ambitious 2026 roadmap: secure the developer machine, extend Harden-Runner beyond Linux, and expand protection across package ecosystems.Nx Consolesupply chain attacks of the year: the Axios npm compromise, the Shai-Hulud attack on TanStack, the Nx Console VS Code extension compromise that led to the breach of roughly 3,800 GitHub internal repositories (per Secret Exfiltration ProtectionSecret Exfiltration Protection for GitHub ActionsBlocks workflows planted to steal repository secrets Secure Registryteams deploy preventive controls at every stage before an attack ever lands: package cooldown and Secure Registry keep freshly published versions out of builds and off developer machines, Device Policy locks down TanStackmost consequential supply chain attacks of the year: the Axios npm compromise, the Shai-Hulud attack on TanStack, the Nx Console VS Code extension compromise that led to the breach of roughly 3,800 GitHub internal Threat Center APIThreat Center API and threat intelligence feedsResearch becomes automated, org-wide protection

Industries