# Developer credential exposure on dev machines: StepSecurity Dev Machine Guard credential-source inventory (context: TeamPCP stealer, Bitwarden CLI npm hijack, Shai-Hulud)

> StepSecurity's Dev Machine Guard (agent v1.16.0+) now inventories 13 credential source types across five categories on developer machines, the same well-known file locations that recent supply-chain stealers target. The cited incidents are the TeamPCP-branded xinference PyPI compromise (April 2026), the Bitwarden CLI npm hijack (@bitwarden/cli@2026.4.0, April 2026) and the second Shai-Hulud npm worm wave (November 2025).

- **Published:** 2026-10-21T03:28:37Z
- **Last reviewed:** 2026-10-21T03:28:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4004
- **ID:** TL-2026-4004
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The source article (StepSecurity, 2026-08-25) is a vendor product announcement, not a primary incident report. Dev Machine Guard now reports where developer credentials live and how widely they are spread across a fleet, including how many are stored without encryption or passphrase protection. It covers 13 credential source types in five categories: cloud (AWS credentials, gcloud application default credentials), source control (GitHub tokens, ~/.git-credentials, SSH keys id_rsa/id_ed25519/id_ecdsa), package registries (~/.npmrc, ~/.pypirc), containers (~/.docker/config.json) and infrastructure (Vault tokens, kubeconfig, ~/.netrc). Agent v1.16.0 is the earliest version with the inventory; on macOS, Full Disk Access via MDM is needed to read TCC-protected paths, and the inventory populates after the next device scan following the upgrade.

The article justifies the inventory with three supply-chain incidents in which malicious package code harvested exactly these locations. (1) xinference on PyPI: versions 2.6.0, 2.6.1 and 2.6.2 were published with a two-stage stealer in xinference/__init__.py that runs on import. A base64 wrapper carrying a '# hacked by teampcp' marker launches a detached Python subprocess that collects SSH keys, AWS/GCP/Azure/Docker/Kubernetes credentials, .env files (up to 6 directory levels), CI/CD configs, TLS private keys, .npmrc/.pypirc/.netrc, shell history and cryptocurrency wallets, makes live calls to AWS Secrets Manager and SSM Parameter Store with harvested credentials, packs the output into love.tar.gz and POSTs it unencrypted via curl to whereisitat.lucyatemysuperbox.space with header X-QT-SR: 14. The versions were detected and yanked on 2026-04-22. TeamPCP's own account reportedly disclaimed the xinference compromise as the work of a copycat, so attribution is disputed.

(2) @bitwarden/cli@2026.4.0 on npm was live from 5:57 PM to 7:30 PM ET on 2026-04-22 (about 334 downloads), published through a compromised GitHub Actions workflow in Bitwarden's CI/CD pipeline as part of the wider Checkmarx supply-chain campaign. A new preinstall hook runs bw_setup.js, which downloads the Bun runtime (v1.3.13) and executes the 9.7 MB obfuscated payload bw1.js. The payload steals GitHub/npm tokens, SSH keys, git credentials, shell history, AWS/GCP credentials and AI coding tool configuration (Claude Code ~/.claude.json, Cursor, Kiro, Codex CLI, Aider, MCP configs). It encrypts the data with AES-256-GCM and sends it to audit.checkmarx.cx/v1/telemetry, with GitHub-commit and victim-repository fallback channels. It also weaponizes any GitHub token it finds to enumerate repositories, pull Actions secrets and inject workflows, adds shell RC persistence, and skips Russian-locale systems. Bitwarden shipped 2026.4.1 as a re-release of 2026.3.0.

(3) Shai-Hulud second wave (Sha1-Hulud: The Second Coming, detected around 2025-11-21 to 2025-11-24): npm packages carry a setup_bun.js preinstall dropper and a 10 MB+ obfuscated bun_environment.js payload. The worm steals npm tokens, GitHub tokens and cloud credentials, creates public exfiltration repositories described 'Sha1-Hulud: The Second Coming' and registers a self-hosted runner named SHA1HULUD. Stolen npm tokens are used to republish additional compromised packages (up to 100 per victim), and on authentication failure the payload attempts destructive file wiping (shred on Linux/macOS).

Defender takeaway: the credential files these stealers read are the same ones the inventory enumerates, so reducing unencrypted long-lived secrets on developer machines (passphrase-protected SSH keys, short-lived cloud credentials, avoiding plaintext tokens in .npmrc/.pypirc/.git-credentials), disabling lifecycle scripts in CI (npm ci --ignore-scripts) and pinning dependencies reduces blast radius. Severity MEDIUM and status MONITORING are analyst-assigned, not stated in the source.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1059.006 Python
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1546.004 Unix Shell Configuration Modification
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1087.004 Cloud Account
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1567.001 Exfiltration to Code Repository
- T1485 Data Destruction

## Sources

- [Dev Machine Guard Now Inventories Where Developer Credentials Live (StepSecurity)](https://www.stepsecurity.io/blog/dev-machine-guard-now-inventories-where-developer-credentials-live)
- [TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package (StepSecurity)](https://www.stepsecurity.io/blog/teampcp-injects-two-stage-credential-stealer-into-xinference-pypi-package)
- [Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools (StepSecurity)](https://www.stepsecurity.io/blog/bitwarden-cli-hijacked-on-npm-bun-staged-credential-stealer-targets-developers-github-actions-and-ai-tools)
- [Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent npm Packages Compromised (StepSecurity)](https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised)
- [Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (The Hacker News)](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html)
- [TeamPCP strikes again: Xinference PyPI package compromised (JFrog)](https://research.jfrog.com/post/xinference-compromise/)
- [Xinference allegedly hacked by TeamPCP, malicious package in PyPI (OX Security)](https://www.ox.security/blog/xinference-allegedly-hacked-by-teampcp-malicious-package-in-pypi/)
- [Bitwarden CLI Supply Chain Compromise (SafeDep)](https://safedep.io/bitwarden-cli-supply-chain-compromise/)
- [Bitwarden CLI 2026.4.0 infected with malware (Bitwarden Community)](https://community.bitwarden.com/t/bitwarden-cli-2026-4-0-infected-with-malware/96126)
- [Shai-Hulud 2.0 Deep Dive and Actionable Steps You Should Take (Cycode)](https://cycode.com/blog/shai-hulud-2-0-deep-dive-and-actionable-steps-you-should-take/)
- [SANS ISC Diary 32926 (xinference compromise)](https://isc.sans.edu/diary/32926)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4004