Dev Machine Guard Now Supports Linux - StepSecurity

What it is

StepSecurity's Dev Machine Guard now has a native Linux build, alongside its existing macOS and Windows agents. It's a scanner that inventories developer workstations for supply-chain risk (installed npm/PyPI packages, IDE extensions, AI agents/CLIs, MCP server configs) so security teams can answer "which of our machines has the compromised package installed?" across a mixed fleet from one dashboard.

How it works

The Linux agent uses native mechanisms rather than emulating macOS conventions:

• Application discovery via /opt/, /usr/share/*.desktop entries, and $PATH lookups.
• Device identity derived from the BIOS serial number (Linux exposes no macOS-style hardware serial).
• Scheduled scanning runs as a systemd user timer installed under the developer's own account — no root daemon, no system-wide service, no manual unit-file editing.
• Package detection uses each manager's native query, e.g. rpm -qa, snap list, flatpak list; coverage spans rpm, dpkg, pacman, apk, snap, flatpak.

Coverage also includes AI coding agents (Claude, Cursor, Copilot, Codex), AI CLIs, VS Code Marketplace and OpenVSX extensions across VS Code/Cursor/Windsurf/JetBrains, and MCP server configurations.

Preconditions / Affected

• AMD64 (x86_64) only — shipped as .deb and .rpm. No ARM build is mentioned.
• Tested on Debian- and RPM-based distributions.
• Release artifacts are signed with Sigstore and carry build provenance attestations.

What to do

Two tiers, with different data-handling implications worth noting before rollout:

• Community mode is a free open-source binary that runs fully locally — produces a JSON or HTML report, nothing leaves the machine. Suitable for individual developers/OSS maintainers. Source and detection logic: github.com/step-security/dev-machine-guard.
• Enterprise mode reports scans to the StepSecurity backend for a centralized dashboard, policy enforcement (IDE extensions, MCP servers, AI agents, packages), cooldown periods on newly published npm/PyPI packages, alerting on compromised dependencies, and historical/incident triage.

Install by deploying the .deb/.rpm and pointing it at your tenant; if you already run macOS/Windows agents, the tier model and workflow are identical. Full rollout guidance is in the vendor's Installation Script documentation.

Caveats

This is a vendor announcement, not an advisory — no CVEs or IOCs. The named incidents (Shai-Hulud npm worm, s1ngularity Nx compromise, Mini Shai-Hulud / TanStack) are cited as motivation, not detected/patched here. Note the trust boundary: Community mode is local-only, while Enterprise mode transmits full machine inventory (installed packages, extensions, hostname, BIOS serial) to StepSecurity's backend — evaluate that against your data-handling requirements before choosing a tier.