Cycode Launched Workstation Protection Software

The new tool targets malicious code packages on developer computers to prevent supply chain security threats.

Updated on Sept. 23, 2026 in Cybersecurity

Bold flat-color editorial illustration in navy, cream, and red, representing the conceptual security of a developer workstation. — Cycode launched Workstation Protection software, a new security tool designed to identify and block malicious code packages within developer environments. AI Illustration. Upload story photo >

Live Poll

Do you trust the automated security tools and software packages currently running on your workstation?

Cycode has released Workstation Protection, a security software designed to block malicious software packages on developer computers. The tool utilizes threat intelligence feeds and release-age gating to identify and neutralize risks from weaponized open-source code.

Why it matters

The software directly addresses growing vulnerabilities stemming from attackers who weaponize open-source packages and coding agents. This technology aims to provide centralized security oversight for developers who are increasingly targeted by sophisticated supply chain attacks.

The system deploys through Mobile Device Management software to enforce central cooldown policies. It relies on a threat intelligence feed alongside age-based gating to vet newly published packages.

The players

Cycode

Cycode is a software supply chain security company based in San Francisco that provides platforms for protecting developer environments.

The details

Cycode Workstation Protection integrates into developer environments to detect malicious actors, such as those responsible for recent supply chain worms. It specifically mitigates risks observed in incidents like the Keyv account hijacking and the malicious packages found in LiteLLM.

November 2025: A self-replicating npm worm in Shai-Hulud 2.0 exfiltrated secrets.
March 2026: Attackers published two malicious packages within the LiteLLM library.
August 2026: A hijacked maintainer account for Keyv seeded a preinstall worm.
September 23, 2026: Cycode officially launched Workstation Protection.

The Tech Race

This release follows a pattern set by the rise of open-source software supply chain attacks by implementing automated gating to block malicious code injection. It marks a shift from reactive perimeter defense to proactive, device-level oversight of the developer toolchain.

Developers and security teams can now automate the blocking of risky open-source packages through centralized policies. This transition reduces the manual burden of vetting every new dependency while maintaining a stronger security posture against compromised accounts.

The takeaway

Organizations should prioritize securing developer workstations as a primary vector for supply chain breaches. Proactive gating policies help defend against the rapid weaponization of popular code packages.