Skip to content

Back to the catalog

Dev Machine Guard Now Supports Windows - StepSecurity
stepsecurity.ioarticle

Dev Machine Guard Now Supports Windows - StepSecurity

StepSecurity announces Windows 10/11 support (x64 and ARM64, Sigstore-signed with build provenance) for Dev Machine Guard, its open-source developer-endpoint scanner. It inventories AI coding agents, MCP server configs, IDE extensions from the VS Code Marketplace and OpenVSX, and global and per-project npm packages. This lets teams find which developer machines have a compromised package or extension after incidents like Shai-Hulud, s1ngularity and Mini Shai-Hulud. Windows detection uses %LOCALAPPDATA%, %PROGRAMFILES%, registry Uninstall keys and schtasks scheduling. Community mode runs fully locally, while enterprise mode reports to a dashboard with policy enforcement.

TL;DR StepSecurity's open-source Dev Machine Guard now scans Windows developer machines for AI agents, MCP servers, IDE extensions and npm packages, to speed up supply-chain incident scoping.
Open original ↗

Organisations named here

  • CISA
  • Shai-Hulud

Technologies named here

  • Windows 10 and Windows 11 developer machines
  • Sigstore
  • macOS developer machines
  • AI coding agents
  • Windows Task Scheduler for scheduled scanning
  • MCP servers configured for AI agents
  • Windows Registry for version info
  • MDM and Group Policy for rollout
  • npm packages
  • TanStack npm packages
  • Nx
  • GitHub Actions runners
  • Windows 10
  • Dev Machine Guard
  • VS Code Marketplace
  • Windows 11
  • macOS
  • Open VSX Registry
  • GitHub Copilot
  • Cursor
  • Windows Task Scheduler
  • Windows Registry
  • Claude
  • Codex
  • VS Code
  • JetBrains products
  • Windsurf
  • Antigravity
  • @tanstack/* packages
  • StepSecurity
  • Windows
  • npm
  • Model Context Protocol
  • Open VSX

Techniques named here

  • Supply chain attacks against developer machines
  • Elevated-permission installation of AI coding agents
  • MCP server abuse
  • Malicious/compromised IDE extension auto-update
  • npm supply chain compromise
  • Credential exfiltration via AI CLI tools
  • OIDC token theft from CI/CD runners

Threat actors named here

  • Shai-Hulud npm worm campaign
  • s1ngularity Nx compromise
  • Mini Shai-Hulud wave
  • Shai-Hulud npm worm
  • s1ngularity
  • Mini Shai-Hulud

Related in Supply Chain