StepSecurity Adds Package-Configuration Auditing to Dev Machine Guard
Summary
StepSecurity announced Package Configs, a Dev Machine Guard feature that audits developer machines’ package registries, cooldown settings and credential exposure to help identify gaps exploited by npm and PyPI supply-chain attacks.
Key points
- Package Configs inventories npm, pnpm, bun, yarn and pip configuration files across global, user and project scopes on developer machines.
- It reports each device’s effective package registry and the configuration source, helping identify machines that fetch directly from public registries rather than an internal registry or gateway.
- The feature flags missing or unsupported cooldown settings, including cases where a package-manager version must be upgraded.
- It identifies registry credentials hardcoded in configuration files versus credentials referenced through environment variables.
- StepSecurity describes cooldown and controlled internal registries as defenses against freshly published malicious package versions.
- The feature is part of Dev Machine Guard, uses its existing agent, and is described as supporting macOS, Windows and Linux.
Article Details
- Event Type
- Security product feature announcement
- Impact
- StepSecurity announced Package Configs for Dev Machine Guard, available in the dashboard for existing users. It audits package-manager configuration across developer machines to identify registry-routing gaps, missing or unsupported cooldown policies, and hardcoded registry credentials. The feature is intended to help security teams find and remediate exposure to compromised packages; it provides visibility into these controls rather than itself blocking packages. The article reports that the Miasma npm wave compromised 57 packages across more than 286 malicious versions and that Hades later compromised ensmallen and roughly two dozen related packages.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe article describes compromised package versions being published and installed on developer machines as part of software supply-chain attacks.T1552.001 · Credentials In FilesThe article says Miasma and Hades harvest registry publishing tokens, including tokens stored in package-manager configuration files.
Malware
Hadesthe axios and TanStack compromises, the Shai-Hulud worm, and most recently the fast-spreading Miasma and Hades worms. They share a pattern. A trusted package ships a malicious version, it installs on a developer'sMiasmaecosystems: the axios and TanStack compromises, the Shai-Hulud worm, and most recently the fast-spreading Miasma and Hades worms. They share a pattern. A trusted package ships a malicious version, it installs on aShai-Huludof supply chain attacks has hit the npm and PyPI ecosystems: the axios and TanStack compromises, the Shai-Hulud worm, and most recently the fast-spreading Miasma and Hades worms. They share a pattern. A trusted
Vendors
Products
Dev Machine GuardThe catch is that these controls only protect a machine that is actually configured to use them. Dev Machine Guard's new Package Configs feature shows you, across your entire fleet, exactly how each developernpmOver the past few months, a wave of supply chain attacks has hit the npm and PyPI ecosystems: the axios and TanStack compromises, the Shai-Hulud worm, and most recently the fast-spreading Miasma and Hades worms. TheyPackage Configscontrols only protect a machine that is actually configured to use them. Dev Machine Guard's new Package Configs feature shows you, across your entire fleet, exactly how each developer machine fetches packages:PyPIOver the past few months, a wave of supply chain attacks has hit the npm and PyPI ecosystems: the axios and TanStack compromises, the Shai-Hulud worm, and most recently the fast-spreading Miasma and Hades worms. TheyStepSecurity Secure Registrystrongest defenses against this already exist: routing every install through an internal registry or Secure Registry that blocks known-compromised packages, and a cooldown policy that keeps brand-new versions out of