Code is being written everywhere, and the device is the only constant

The article warns that development workflows are fragmenting across Slack, AI agents, MCP servers, and extensions, expanding the software supply-chain attack surface; it cites recent real incidents (TeamPCP credential chaining, an Axios maintainer hijack distributing a RAT, the Glassworm backdoor in VS Code extensions, and a malicious MCP server on npm) to show how developer devices are the primary target and advocates device-level protection to detect and block malicious installs.