cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Announces Beta Guard for Developer Machines and AI Coding Agents

· Original article ↗

Summary

StepSecurity announced its beta Dev Machine Guard for monitoring developer-machine dependencies, IDE extensions and AI-agent activity, with risk policies such as extension allowlists, package cooldowns and blocking known malicious components.

Key points

  • Dev Machine Guard extends StepSecurity's supply-chain security platform to developer machines and AI-assisted workflows; the product is in beta.
  • The product offers visibility into locally installed npm and Python dependencies and VSCode and Cursor extensions, with risk assessment.
  • Announced controls include extension allowlists and blocklists, cooldown periods for new package versions, alerts and automated blocking of known malicious components.
  • The product is designed to monitor AI coding agents and tools, including MCP servers, and apply policies to both human- and agent-driven actions.
  • StepSecurity says the tool is deployed through a lightweight script using existing MDM or EDR infrastructure and gathers telemetry periodically or on demand.
  • The article cites Trust Wallet's report that exposed developer GitHub secrets enabled access to source code and publishing credentials used to release a malicious browser extension; Trust Wallet said it had high confidence the incident was linked to Shai Hulud.

Article Details

Event Type
Security product announcement
Impact
StepSecurity introduced Dev Machine Guard, a developer-machine security product currently in beta, with visibility and policy controls for local dependencies, IDE extensions, and AI coding agents. The article cites several supply-chain incidents: Trust Wallet reported that an unauthorized malicious version of its browser extension (v2.68) affected users who logged in from December 24 to 26, 2025; it reported 2,520 affected wallet addresses and estimated about $8.5 million in impacted assets. Trust Wallet said it had high confidence the incident was linked to the November 2025 Shai Hulud supply-chain attack, and described exposed developer GitHub secrets enabling access to source code and publishing credentials. The article also reports that leaked tokens enabled malicious updates to more than 100 VSCode extensions affecting over 150,000 developers, and that the August 2025 s1ngularity attack involved the Nx package and affected a package with 4 million weekly downloads.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe article describes compromised npm packages and malicious software updates being used to reach developer machines and affect software releases.

People

Colin BarrIdentified as Head of InfoSec and IT at Paddle; provided a customer perspective on the risks of compromised VSCode extensions and npm packages and StepSecurity's Dev Machine Guard.

Vendors

StepSecurityIntroducing StepSecurity Dev Machine GuardTrust WalletReal-World Impact: Trust Wallet shows how a developer machine compromise becomes a release compromise

Products

Harden-RunnerHarden-Runner would detect anomalous network calls and process execution in CI/CD if the malicious package reached your build pipelinenpm Package Securitynpm Package Security would flag newly published malicious package versions via cooldown periods, preventing their adoption during the critical attack windowNxinstalling dependencies and executing tools with those same privileges. Campaigns like Shai Hulud and the Nx s1ngularity incident harvested developer tokens and keys, then used them to spread further and publishStepSecurity Dev Machine GuardIntroducing StepSecurity Dev Machine GuardTrust Wallet browser extensionA recent incident involving the Trust Wallet browser extension illustrates the new “endpoint to release” attack path.VSCodeOver 100 VSCode Extensions Exposed 150,000+ Developers

Industries

Software developmentComplete Coverage Across the Software Development Lifecycle

Related Articles