Stepsecurity
stepsecurity.io
Actively hiring
Application Security
DevSecOps
As featured in
Follow
Overview
News
Salaries
Products
People
Growth
Offices
Financials
Funding and backers
Total raised
$30k
1 round on record
Latest round
$30k
Convertible Note · May 2023 · 3 yr ago
Team
4
US Form 5500 (plan participants) · Dec 2025 · +33% in a year
The money's age
Long since its last round
41 months since the last round · not hiring
Momentum
15/100
in the news
Last sign of life
this month
a posting or a news item
The story so fareach stage dated by its source: the company's releases, the press, registers, filings
Mar 31
On the Hacker News front page Axios compromised on NPM – Malicious versions drop remote access trojan · 1934 points
Mar 14, 2025
On the Hacker News front page Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos · 273 points
Jan 17, 2024
Launched on Hacker News Show HN: GitHub Actions Advisor – View security scores of GitHub Actions you use
May 16, 2023
Raised a round Convertible Note $30k · SEC Form D
2021
Founded
Tractionpublic signals, read monthly
Funding rounds
| Round | Date | Amount | Investors | Source |
|---|---|---|---|---|
| Convertible Note | May 2023 | $30k | — | SEC Form D |
Registers and programsofficial lists and records that name the company
| Legal entity | Step Security, Inc. | SEC Form D |
Founders and leadersfrom filings, registers and the company's site
Varun SharmaExecutive Officer, DirectorSEC Form D
Investors in similar startupsfunds that back the companies most like this one
Similar startupsby what they do, their industry and backers
SafeDep helps teams detect malicious packages, protect AI agents, and govern open source risk across developer machines, CI/CD pipelines…
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams…
Black Duck is a leading application security enterprise specializing in software supply chain security and open-source risk management. The…
Endor Labs is an application security company founded in 2021 that builds a platform for securing both human-written and AI-generated code…
Semgrep is a software security company that develops static analysis tools for finding bugs and vulnerabilities in source code. Its…
The secure software supply chain for critical infrastructure. Determinate gives engineering teams control over the code, dependencies…
News
ChainDrop credential stealing worm infects over 400 npm packages
The Shai Hulud variant's blast radius includes several highly popular packages thus far.. Security teams are urged to perform full audits of all developer machines.
Read more
Report
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and lateral movement.
Read more
Report
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Two @joyfill npm beta packages run an import-time implant that uses Tron, Aptos, and BSC to deliver a DEV#POPPER-linked Node.js RAT.
Read more
Report
SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
Three malicious RubyGems packages in the SleeperGem attack skip CI runners, target developer machines, and install persistent native malware.
Read more
Report
AsyncAPI npm packages infected with credential-stealing malware
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.
Read more
Report
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised AsyncAPI npm packages load a multi-stage botnet from IPFS after attackers abuse GitHub Actions, despite valid provenance attestations
Read more
Report
NPM ecosystem hit with two new supply chain compromises
Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with malware.
Read more
Report
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Malicious jscrambler 8.14.0 runs hidden binaries during npm install on Windows, macOS, and Linux, with no fix available as of July 11, 2026.
Read more
Report
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK project
Read more
Report
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Unknown attackers compromised Injective Labs' GitHub repo to publish npm package 1.20.21, which steals wallet private keys and seed phrases.
Read more
Report
Show more news
People
Varun Sharma
Executive Officer, Director
Names and roles come from public filings, company registers and the company's own site. Is this you? Correct or remove · How we handle this data
Offices
Where the company hires and what each office is for
Cities
2
Hiring now
0
Countries
1
Loading the map
Headquarters
Builds here
Office with open vacancies
No open vacancies right now Tap a pin for the office
Sammamish
United States
HQ
Washington
United States
Registered seat
Financials
Total raised
$30k
Latest round
Convertible Note
Funding rounds
1
Funding rounds
| Round | Announced | Amount | |
|---|---|---|---|
| Convertible Note | 2023 | $30k | Details |