Honeytokens on the Developer Workstation: When Cleanup Takes Time

Supply chain security has moved closer to the humans with hands on the keyboard. For years, security teams have treated production systems, CI/CD pipelines, and identity infrastructure as the most sensitive parts of the software lifecycle. That is not wrong, but it is incomplete. The developer workstation belongs in that same conversation because it sits at the intersection of privilege, trust, and execution. It is where code is written, dependencies are installed, credentials accumulate, and trusted actions begin. Modern supply chain attacks are increasingly designed to land on the developer machine first. They do not need to smash through the front gate of production if they can quietly collect the keys from the laptop that already has access to private repositories, package publishing workflows, cloud consoles, build systems, and internal tooling. In 2025, and for the first time, campaigns such as Shai-Hulud showed us publicly just how many credentials could be harvested from a deve