New · under observation
step-security/dev-machine-guard
Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.
- Repository created
- Mar 10, 2026
Observing since Nov 7, 2026. Final review from Dec 7. Listed automatically.
Activity
Daily measurements 2 readings
How measurements work
Hourly checks may be delayed by hosting or rate limits. Times are UTC. Daily views include today in UTC. Daily totals use the last reading; commits sum intervals ending that day. Missing readings are not zero activity.
| Date · UTC | Stars | Star change | Forks | Open issues & PRs | Commits / interval |
|---|---|---|---|---|---|
| Nov 8, 2026 19:59 | 196 | 0 | 27 | 33 | 0 / 20.8h |
| Nov 7, 2026 23:12 | 196 | — | 27 | 33 | 0 / 3.1h |
Plan a pilot
Download a brief to share with the team. Nothing is sent or saved.
Developments
Past 30 days · Checked Nov 8, 20:22 UTC
- CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux ↗
- CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root ↗
- Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines ↗
- Binance’s $6.34 Billion Hack: Developer Machines, AI Tooling, and Wallet Signing ↗
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines ↗
- GitHub Actions Native Egress Firewall vs. Harden-Runner: Five Differences That Matter ↗
- StepSecurity Now Inventories AI Agent Plugins in Your GitHub Repositories and on Developer Machines ↗
- litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader ↗
- OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found ↗
- eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update ↗
Reported by linked sources.
About these listings
Workflow categories are inferred from repository descriptions. New listings are under observation and await a final review after 30 days. Product capabilities, funding and customer adoption are unverified.
GitHub activity reflects development and attention. It does not establish product quality or business results.