Topic
Security practices and tools protecting developer workstations and CI/CD build machines from malware, supply-chain attacks, and credential theft.
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
Reality
Cycode's Workstation Protection, now in early access, screens installs against a threat intelligence feed and holds back packages updated too recently to vet. It ships inside the device management module Cycode already installs.
Reality
Japan, Germany, Australia and the US say one North Korean group infected 30,000 devices in more than 100 countries to steal $10.7 million, a thin cash yield that points at the identity documents it also took.
Reality
Microsoft's Defender Experts date the Contagious Interview campaign to December 2022. Its payload lands at the one hiring stage where a candidate is expected to clone and run a stranger's code. The same team tells employers to give staff a non-persistent VM for coding tests.
Reality
Mitiga Labs says an npm post-install hook can repoint Claude Code's MCP endpoints at attacker infrastructure while the SaaS provider keeps logging a real user session arriving from Anthropic's egress range.
Reality
A trojan disguised as a Font Awesome font ran from a VS Code automatic task for eleven weeks and force-pushed rewritten commits into eighteen repositories, signed with the developer's own passphrase-free SSH key.
Reality
Verizon's 2026 report puts credential abuse in 39% of fully traced breach chains. GitGuardian's account of how infostealers work explains why the developer endpoint is the cheapest place to collect them.
Reality
Unit 42 says a worm hidden in more than 400 npm packages read GitHub Actions runner memory for temporary OIDC tokens. An SBOM generated at the end of the build would not have seen any of it.
Reality
The company extended just-in-time access, live session monitoring and device trust to Linux workstations this month, treating the laptop as production infrastructure rather than a trusted edge.
Reality