cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Adds Cross-IDE Extension Inventory and Risk Scoring

· Original article ↗

Summary

StepSecurity says Dev Machine Guard now inventories extensions and plugins across multiple IDE families on macOS, Windows and Linux, with per-item metadata, supply-chain risk scoring, and detection of known compromised and typosquat extensions.

Key points

  • Dev Machine Guard scans extensions and plugins across Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode on macOS, Windows, and Linux.
  • The inventory records each item's name, publisher, identifier, version, installation type, IDE, and the fleet devices where it is present.
  • The product's Security Score uses signals including adoption, release recency, publisher verification, license availability, known vulnerabilities, and repository security posture.
  • A Risk Type filter identifies extensions StepSecurity classifies as compromised or typosquats, using its supply-chain threat intelligence.
  • The company says extension allowlists and cooldown periods for new versions are under development.
  • StepSecurity says community-mode data stays on the machine, while enterprise mode sends consolidated inventory and scores to its dashboard.

Article Details

Event Type
Expanded product capability: Dev Machine Guard now scans and inventories IDE extensions across multiple IDE families and operating systems.
Impact
Provides organizations with a consolidated, cross-platform inventory of installed IDE extensions and plugins, including versions, fleet presence, security scores, and detections for known compromised or typosquatted extensions. This can support incident response and risk-prioritized review. The article describes the capability but does not report a measured reduction in incidents or compromise.

Malware

Shai-HuludThe Shai-Hulud npm worm campaign compromised 500+ packages and earned a CISA advisory, with several affected packages sitting as transitive dependencies of widely installed extensions.

Vendors

StepSecurityThese detections are powered by StepSecurity's supply chain threat intelligence and are updated as new incidents are confirmed.

Products

Android Studioacross eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically on macOS, Windows, and Linux.AntigravityGuard now scans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically on macOS,CursorDev Machine Guard now scans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically onDev Machine GuardDev Machine Guard now scans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically onEclipse-based IDEsIDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically on macOS, Windows, and Linux.JetBrains IDEsscans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically on macOS, Windows, andVSCodeDev Machine Guard now scans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically onWindsurfDev Machine Guard now scans IDE extensions across eight IDE families: Visual Studio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically onXcodeStudio Code, Cursor, Windsurf, Antigravity, JetBrains IDEs, Android Studio, Eclipse-based IDEs, and Xcode. Coverage works identically on macOS, Windows, and Linux.

Related Articles