Attackers want your developers’ laptops
Poisoned packages and extensions keep targeting developers for their tokens. A developer machine often has the keys to production.
The supply-chain attacks of March didn’t stop. Researchers keep reporting poisoned packages, CLI tools and editor extensions built for one job: steal GitHub tokens, npm and PyPI tokens, SSH keys and cloud credentials from developer laptops and build servers.
It makes sense. A developer’s machine can often push code, publish packages and reach production. It’s also where people install new tools every week.
- Use short-lived credentials: SSO for cloud CLIs, fine-grained GitHub tokens with expiry dates.
- Keep SSH keys and tokens out of plain files where possible. Use the OS keychain, a hardware key or the password manager’s agent.
- Require MFA, ideally passkeys, for publishing packages and for the source code platform.
- Be picky with editor extensions. They run with your full access.
- Production deploys go through CI with reviewed changes, not from a laptop.