Attackers Hit Developer Workstations to Harvest CI/CD Credentials

Developer workstations are identified as a real part of the software supply chain, with attackers increasingly targeting secrets stored in developer environments and CI/CD pipelines. In a 48-hour window, three campaigns hit npm, PyPI and Docker Hub, all aiming to exfiltrate API keys, cloud credentials, SSH keys and tokens.

The piece argues that the developer workstation concentrates context such as local repos, environment variables and build scripts, turning it into a critical delivery authority rather than a mere endpoint. It warns that automated and AI-assisted workflows can accelerate the theft and misuse of credentials, making credential harvesting a central objective of modern supply chain attacks.

The article advocates treating the workstation as a local supply chain boundary and urges security teams to consider how credentials are used, rotated and revoked at this layer, bridging gaps between AppSec, endpoint, identity and cloud security. according to The Hacker News