StepSecurity Dev Machine Guard adds fleet-wide developer credential inventory to close blind spot exploited by supply-chain attacks
StepSecurity Dev Machine Guard adds fleet-wide developer (TL-2026-2160), also tracked as Shai-Hulud: The Third Coming, is a info-severity tracked intrusion set, first published 2026-08-25. It is attributed to TeamPCP with medium confidence, affects StepSecurity Dev Machine Guard (agent), maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2160
- Threat ID
- TL-2026-2160
- Also known as
- Shai-Hulud: The Third Coming, TeamPCP Campaign Update 008
- Severity
- INFO
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-08-25
- Last reviewed
- 2026-08-25
- Attribution
- TeamPCP
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cloud infrastructure, devops ci-cd
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in StepSecurity Dev Machine Guard adds fleet-wide developer
Malware and tooling: SANDCLOCK, Bun runtime v1.3.13
StepSecurity's Dev Machine Guard agent v1.16.0 (August 25, 2026) adds fleet-wide inventory of thirteen developer-credential source types (AWS, GitHub, SSH, git-credentials, npm, PyPI, Docker, Vault, kubeconfig, netrc, gcloud) reporting plaintext-vs-protected status without ever collecting credential values. The vendor motivates the feature by citing the April 2026 TeamPCP/UNC6780 campaign, in which the same credential paths were systematically harvested via the compromised xinference PyPI package and the hijacked @bitwarden/cli npm package.
How StepSecurity Dev Machine Guard adds fleet-wide developer works
On August 25, 2026, StepSecurity shipped Dev Machine Guard agent v1.16.0, extending its developer-endpoint monitoring product with a credential-location inventory capability. The feature enumerates thirteen credential source types across cloud (AWS credentials/config, gcloud application-default credentials), source control (GitHub tokens, git-credentials, SSH keys), package registries (npm .npmrc, Python .pypirc), containers (Docker config), and infrastructure tooling (Vault tokens, kubeconfig, netrc) in both default and relocated file locations. For each device it records file existence, quantity of material present, and — for SSH keys specifically — whether the private key is passphrase-protected, while explicitly never serializing, logging, storing, displaying, or exfiltrating credential values, fragments, hashes, digests, fingerprints, or parser output.
The vendor grounds the release in a real and still-unfolding attacker technique class: systematic enumeration and harvesting of exactly these credential storage locations across developer machines and CI/CD runners, as demonstrated in a cluster of April 2026 open-source supply-chain compromises attributed with varying confidence to TeamPCP (tracked by Google's Threat Intelligence Group as UNC6780, credential stealer 'SANDCLOCK'). On April 22, 2026, three concurrent compromises hit npm, PyPI, and Docker Hub within roughly 48 hours: the xinference PyPI package (versions 2.6.0-2.6.2) shipped a two-stage credential stealer injected into its top-level __init__.py that executed on every import; the official @bitwarden/cli npm package (version 2026.4.0) was briefly republished with a Bun-runtime-staged, AI-tool-aware credential stealer after a Bitwarden engineer's GitHub account was compromised and the npm publish workflow was rewritten to abuse OIDC Trusted Publishing; and the checkmarx/kics Docker Hub image was overwritten with a build that both exfiltrated IaC scan output and delivered a secondary payload via trojanized VS Code extensions. Analysis published by SANS ISC (the 'Update 008' campaign diary) further ties these events to a cascading failure — Bitwarden's own Dependabot automation pulled the poisoned checkmarx/kics image, propagating the compromise into the CLI release — and to a parallel npm worm ('CanisterSprawl') first identified April 21 across multiple publisher namespaces, which self-propagates via postinstall hooks and can pivot from npm to PyPI when it finds a PyPI publish token on an infected host.
No CVE has been assigned to any of the referenced package/image compromises; this record documents a defensive-tooling release, not a vulnerability. It is included because the vendor's stated rationale — closing the visibility gap that active supply-chain campaigns already exploit to enumerate developer-credential storage — maps directly onto SOC detection and hunting priorities for credential-theft TTPs on developer endpoints, and the underlying incidents provide concrete, sourced attacker TTPs, IOCs, and file paths that defenders can hunt for independent of whether they adopt this specific tool.
MITRE ATT&CK techniques used in TL-2026-2160
Collection
T1005 Data from Local System; T1560.001 Archive Collected Data: Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API
Lateral Movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Exfiltration
T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Resource Development
Affected products and versions in StepSecurity Dev Machine Guard adds fleet-wide developer
- StepSecurity — Dev Machine Guard (agent)
Vulnerable versions: <1.16.0 (credential inventory feature not available)
Fixed in: 1.16.0 and later (adds credential-location inventory) - Xorbits — xinference (PyPI)
Vulnerable versions: 2.6.0; 2.6.1; 2.6.2
Fixed in: 2.5.0 (last version prior to the compromised releases) - Bitwarden — @bitwarden/cli (npm)
Vulnerable versions: 2026.4.0
Fixed in: 2026.3.0; 2026.4.1 - Checkmarx — checkmarx/kics (Docker Hub image)
Vulnerable versions: latest; v2.1.20; v2.1.20-debian; alpine; debian; v2.1.21; v2.1.21-debian
Fixed in: retagged clean images published after the 2026-04-22 compromise window - Namastex Labs / community publishers — CanisterSprawl-affected npm packages (@automagik, pgserve, @fairwords, @openwebconcept namespaces)
Vulnerable versions: 16+ malicious versions published 2026-04-21 onward
Remediation for StepSecurity Dev Machine Guard adds fleet-wide developer
Patches
- @bitwarden/cli: upgrade to 2026.4.1 (or 2026.3.0 if 2026.4.1 is unavailable)
- xinference: use a version after 2.6.2 that postdates the compromise; do not run 2.6.0, 2.6.1, or 2.6.2
- checkmarx/kics: re-pull the retagged clean images published after the April 22, 2026 12:35-13:59 UTC compromise window for the latest, v2.1.20, v2.1.20-debian, alpine, debian, v2.1.21, and v2.1.21-debian tags
Immediate actions
- Run a fleet-wide developer-credential inventory (Dev Machine Guard or equivalent) across AWS, GitHub, SSH, git-credentials, npm, PyPI, Docker, Vault, kubeconfig, netrc, and gcloud credential locations to find plaintext, unprotected material
- Rotate all credentials on any machine or CI runner that installed xinference 2.6.0-2.6.2, @bitwarden/cli 2026.4.0, or pulled the compromised checkmarx/kics Docker Hub image during the April 22, 2026 compromise windows
- Block outbound network access to audit.checkmarx.cx (94.154.172.43) and whereisitat.lucyatemysuperbox.space
- Audit GitHub organizations for unexpected branches, rewritten Actions workflows (especially publish/release workflows using OIDC Trusted Publishing), and repositories created under developer accounts without their knowledge
Workarounds
- Use npm install/ci --ignore-scripts in CI/CD pipelines until package provenance is verified
- Manually verify absence of bw_setup.js and bw1.js in any node_modules/@bitwarden/cli/ install performed during the compromise window
Longer-term hardening
- Enforce npm ci --ignore-scripts as standing CI/CD policy and pin exact dependency versions to block silent malicious upgrades
- Restrict npm OIDC Trusted Publishing to specific branches/tags rather than any branch in the source repository
- Move SSH private keys and other locally-stored credentials to passphrase-protected or hardware-backed storage; treat unprotected key material found by a credential inventory as a hunting priority, not just a hygiene note
- Extend AI coding-tool configuration (Claude Code, Cursor, Kiro, Codex CLI, Aider) to the same credential-hygiene and monitoring scope as traditional developer secrets, since recent stealers explicitly target them
Weaknesses (CWE) in StepSecurity Dev Machine Guard adds fleet-wide developer
CWE-522, CWE-829, CWE-494
Timeline of StepSecurity Dev Machine Guard adds fleet-wide developer
- TeamPCP-linked litellm PyPI package compromise, part of the same actor's earlier campaign activity.
- Telnyx PyPI compromise disclosed; the TeamPCP campaign then enters an approximately 26-day pause characterized as a credential-monetization phase.
- CanisterSprawl npm worm first identified across at least 16 malicious package versions spanning the @automagik, pgserve, @fairwords, and @openwebconcept publisher namespaces.
- xinference PyPI versions 2.6.0, 2.6.1, and 2.6.2 are published in a single day, each carrying a base64-encoded two-stage credential stealer marked '# hacked by teampcp' in xinference/__init__.py.
- Bitwarden's Dependabot automation pulls the poisoned checkmarx/kics image during the compromise window; @bitwarden/cli 2026.4.0 is published to npm between 5:57 PM and 7:30 PM ET with a Bun-staged credential stealer, reaching roughly 334 downloads before removal.
- At 12:35 UTC, attackers use valid Checkmarx credentials to push malicious checkmarx/kics Docker Hub images (overwriting 5 tags, adding 2 new ones) for an approximately 84-minute window, exfiltrating IaC scan output to audit.checkmarx.cx and delivering a secondary payload via trojanized VS Code extensions.
- SANS ISC publishes 'Update 008,' consolidating the Checkmarx KICS, Bitwarden CLI, and xinference compromises plus the CanisterSprawl npm worm into a single campaign narrative and attributing the operators to Google GTIG's UNC6780 (credential stealer SANDCLOCK).
- StepSecurity ships Dev Machine Guard agent v1.16.0, adding fleet-wide inventory of the thirteen developer-credential source types targeted in the April 2026 campaign, explicitly citing TeamPCP/xinference and the hijacked Bitwarden CLI as motivating incidents.
Sources cited for StepSecurity Dev Machine Guard adds fleet-wide developer
- Dev Machine Guard now inventories where developer credentials live
- TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package
- Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools
- TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises
- Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
- Bitwarden CLI npm package compromised to steal developer credentials
- TeamPCP strikes again: Xinference PyPI package compromised
- TeamPCP Part 4: Malicious Xinference Packages on PyPI
- The Bitwarden CLI Supply Chain Attack: What Happened and What to Do (Shai-Hulud: The Third Coming)
- Bitwarden NPM Package Hit in Supply Chain Attack
More in threat intel
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C Domains Surge +771%
- Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models
- Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport Manager 12.44 (UAT-10820)
Detection coverage for TL-2026-2160
As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2160 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2160
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.