# StepSecurity Dev Machine Guard adds fleet-wide developer credential inventory to close blind spot exploited by supply-chain attacks

> StepSecurity's Dev Machine Guard agent v1.16.0 (August 25, 2026) adds fleet-wide inventory of thirteen developer-credential source types (AWS, GitHub, SSH, git-credentials, npm, PyPI, Docker, Vault, kubeconfig, netrc, gcloud) reporting plaintext-vs-protected status without ever collecting credential values. The vendor motivates the feature by citing the April 2026 TeamPCP/UNC6780 campaign, in which the same credential paths were systematically harvested via the compromised xinference PyPI package and the hijacked @bitwarden/cli npm package.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2160
- **ID:** TL-2026-2160
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 25, 2026, StepSecurity shipped Dev Machine Guard agent v1.16.0, extending its developer-endpoint monitoring product with a credential-location inventory capability. The feature enumerates thirteen credential source types across cloud (AWS credentials/config, gcloud application-default credentials), source control (GitHub tokens, git-credentials, SSH keys), package registries (npm .npmrc, Python .pypirc), containers (Docker config), and infrastructure tooling (Vault tokens, kubeconfig, netrc) in both default and relocated file locations. For each device it records file existence, quantity of material present, and — for SSH keys specifically — whether the private key is passphrase-protected, while explicitly never serializing, logging, storing, displaying, or exfiltrating credential values, fragments, hashes, digests, fingerprints, or parser output.

The vendor grounds the release in a real and still-unfolding attacker technique class: systematic enumeration and harvesting of exactly these credential storage locations across developer machines and CI/CD runners, as demonstrated in a cluster of April 2026 open-source supply-chain compromises attributed with varying confidence to TeamPCP (tracked by Google's Threat Intelligence Group as UNC6780, credential stealer 'SANDCLOCK'). On April 22, 2026, three concurrent compromises hit npm, PyPI, and Docker Hub within roughly 48 hours: the xinference PyPI package (versions 2.6.0-2.6.2) shipped a two-stage credential stealer injected into its top-level __init__.py that executed on every import; the official @bitwarden/cli npm package (version 2026.4.0) was briefly republished with a Bun-runtime-staged, AI-tool-aware credential stealer after a Bitwarden engineer's GitHub account was compromised and the npm publish workflow was rewritten to abuse OIDC Trusted Publishing; and the checkmarx/kics Docker Hub image was overwritten with a build that both exfiltrated IaC scan output and delivered a secondary payload via trojanized VS Code extensions. Analysis published by SANS ISC (the 'Update 008' campaign diary) further ties these events to a cascading failure — Bitwarden's own Dependabot automation pulled the poisoned checkmarx/kics image, propagating the compromise into the CLI release — and to a parallel npm worm ('CanisterSprawl') first identified April 21 across multiple publisher namespaces, which self-propagates via postinstall hooks and can pivot from npm to PyPI when it finds a PyPI publish token on an infected host.

No CVE has been assigned to any of the referenced package/image compromises; this record documents a defensive-tooling release, not a vulnerability. It is included because the vendor's stated rationale — closing the visibility gap that active supply-chain campaigns already exploit to enumerate developer-credential storage — maps directly onto SOC detection and hunting priorities for credential-theft TTPs on developer endpoints, and the underlying incidents provide concrete, sourced attacker TTPs, IOCs, and file paths that defenders can hunt for independent of whether they adopt this specific tool.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1078.004 Valid Accounts: Cloud Accounts
- T1059.006 Command and Scripting Interpreter: Python
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1560.001 Archive Collected Data: Archive via Utility
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

## Sources

- [Dev Machine Guard now inventories where developer credentials live](https://www.stepsecurity.io/blog/dev-machine-guard-now-inventories-where-developer-credentials-live)
- [TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package](https://www.stepsecurity.io/blog/teampcp-injects-two-stage-credential-stealer-into-xinference-pypi-package)
- [Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools](https://www.stepsecurity.io/blog/bitwarden-cli-hijacked-on-npm-bun-staged-credential-stealer-targets-developers-github-actions-and-ai-tools)
- [TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises](https://isc.sans.edu/diary/32926)
- [Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html)
- [Bitwarden CLI npm package compromised to steal developer credentials](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/)
- [TeamPCP strikes again: Xinference PyPI package compromised](https://research.jfrog.com/post/xinference-compromise/)
- [TeamPCP Part 4: Malicious Xinference Packages on PyPI](https://www.mend.io/blog/malicious-xinference-pypi-teampcp-part-4/)
- [The Bitwarden CLI Supply Chain Attack: What Happened and What to Do (Shai-Hulud: The Third Coming)](https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-supply-chain-attack)
- [Bitwarden NPM Package Hit in Supply Chain Attack](https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2160