cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Open-Sources Dev Machine Guard Developer-Tool Scanner

· Original article ↗

Summary

StepSecurity has open-sourced Dev Machine Guard, a Bash script that inventories developer tools, AI agents, MCP configurations, IDE extensions and Node.js packages. Community scans run locally; enterprise mode sends scan data to StepSecurity’s backend.

Key points

  • StepSecurity says the open-source script scans developer machines for IDEs and apps, AI tools and agents, MCP server configurations, IDE extensions, and Node.js packages.
  • The scanner can produce terminal, JSON, or HTML output; Node.js package scanning is opt-in in community mode.
  • StepSecurity says community scans run locally with no data leaving the machine; enterprise mode sends scan data to its backend when tenant information and an API key are provided.
  • Enterprise features include centralized visibility, policy enforcement and alerting, scheduled scans, and historical reporting.
  • The company describes the tool as a way to improve visibility into developer-tool supply-chain risks, citing the Shai-Hulud and s1ngularity campaigns as examples.

Article Details

Event Type
Open-source release of a developer-machine security scanning tool
Impact
StepSecurity released Dev Machine Guard’s core scanning engine as open source. The script inventories developer tools, AI agents, MCP server configurations, IDE extensions, and Node.js packages. Community scans run locally; enterprise mode can send scan data to StepSecurity for centralized visibility, policy enforcement, and reporting.

MITRE ATT&CK

T1078 · Valid AccountsThe article says stolen credentials from the Shai-Hulud campaign were used to bypass release controls.T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes the Shai-Hulud campaign compromising npm packages that executed on developer machines.

Vendors

StepSecurityStepSecurity was one of the first to detect the Shai-Hulud npm supply chain campaign (which earned a CISA advisory after compromising 500+ packages) and the s1ngularity Nx compromise (where a build system with millions

Products

StepSecurity Dev Machine GuardTo bridge this gap, we built StepSecurity Dev Machine Guard for our enterprise customers, giving them a purpose-built way to inventory and secure the developer tooling layer across their fleet.  

Related Articles