Introducing StepSecurity Developer MDM: Protecting Developer Machines from Supply Chain Attacks

Modern supply chain attacks are increasingly targeting developer machines and AI coding agents, which hold credentials such as GitHub tokens, npm publishing credentials, SSH keys, and other secrets that can access production infrastructure. The post notes campaigns like Shai Hulud and the s1ngularity incident, where developer tokens and keys were harvested and used to spread malicious updates, culminating in examples like Trust Wallet’s browser extension breach.

According to Trust Wallet+1, an unauthorized malicious version of its extension (v2.68) was published to the Chrome Web Store affecting users logging in between 24 and 26 December 2025, with 2,520 wallet addresses impacted and an estimated $8.5M in assets affected, and linked to the industry-wide Shai Hulud attack. StepSecurity introduces Developer MDM to provide visibility into IDE extensions and local dependencies, policy-enforcement, and AI coding agent security across human and agent-driven workflows.

The solution is currently in beta, with capabilities including cooldown periods for new package versions and automated blocking of known malicious components, designed to stop attackers from exploiting the earliest pivots on developer machines.