🧰 StepSecurity Dev Machine Guard

The items that name it 13

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeup2026-10-24It is written here as StepSecurity Dev Machine Guard: detects /tmp/envchecker-* directories, unexpected reads of ~/.ovh.conf and ~/.ssh by a CLI process, and invisible variation-selector payloads in source files..
• OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond
  article2026-10-18It is written here as StepSecurity Dev Machine Guard: detects the OpenCode CLI binary, config directory and MCP server configuration on macOS, Windows and Linux; open source, can run as a one-time scan on a single machine.
• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  article2026-10-08

  Organization-wide inventory of AI agent skills detected on developers' machines across supported locations (shared skills directory, agent-specific directories, project-level folders, skills.sh lock file, agent plugins, standalone Claude Code commands), showing agents/scope, source, flags (code/hook

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Inventories installed npm packages and AI agent tooling on enrolled developer devices; finds affected machines and unexpected .claude/.vscode files; checks files against suspicious file rules using known SHA-256 hashes

• Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes
  writeup2026-09-23

  Inventories installed npm and Python packages on enrolled developer devices and checks against threat intelligence.

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeup2026-07-19

  Scans developer machines for malicious files via suspicious files detection; flags SleeperGem artifacts including the gem loader source referencing git.disroot.org, the deploy.sh installer referencing the /usr/local/sbin/ping6 backdoor, and the persistence unit running the daemon from ~/.local/share

• jscrambler npm package publishes malicious preinstall binary
  writeup2026-07-12

  Real-time visibility into npm packages installed across enrolled developer devices, enabling search by package name/version to find impacted machines

• 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers
  writeup2026-07-01

  Fleet-wide inventory and risk-based detection of compromised IDE extensions across developer workstations, across IDEs like IntelliJ IDEA, VS Code, PyCharm, Cursor, GoLand, Eclipse

• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeup2026-07-01

  Gives security teams real-time visibility into npm packages installed across enrolled developer devices; allows searching by package name/version to find impacted machines when a malicious package is identified.

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Gives security teams real-time visibility into npm packages installed across enrolled developer devices, allowing search by package name/version to find impacted machines

• Nx Console VS Code Extension Compromised
  writeup2026-06-02

  Free, open-source tool to detect compromised extensions/packages on local dev machines (community mode); enterprise version detects nrwl.angular-console@18.95.0 via IDE Extensions page

• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeup2026-05-19

  Gives security teams real-time visibility into npm packages installed across enrolled developer devices to find impacted machines when a malicious package is identified.

• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeup

  Gives security teams real-time visibility into npm packages installed across enrolled developer devices; allows searching by package name/version to find impacted machines