Checkmarx KICS Docker Repo Hijacked in Malicious Code Injection Attack

A massive software supply chain attack has targeted the official Checkmarx KICS (Keeping Infrastructure as Code Secure) Docker Hub repository.

Discovered on April 22, 2026, by Docker and Socket, the compromise involves trojanized Docker images and malicious VS Code extensions designed to harvest and exfiltrate highly sensitive developer credentials and cloud infrastructure secrets.

Threat actors successfully infiltrated the Checkmarx/Kics Docker Hub repository by pushing malicious images that overwrote existing, trusted tags.

Affected tags include v2.1.20, v2.1.20-debian, alpine, debian, and latest. The attackers also introduced a fake v2.1.21 tag that did not correspond to any official Checkmarx upstream release.

The compromised KICS images were bundled with a modified Golang binary. This binary was engineered to generate uncensored Infrastructure as Code (IaC) scan reports, encrypt the results, and silently transmit them to an attacker-controlled telemetry endpoint at audit.checkmarx[.]cx/v1/telemetry.

VS Code Extensions and the mcpAddon.js Payload

The breach extended beyond Docker into Checkmarx’s developer tooling. Checkmarx VS Code extensions (versions 1.17.0 and 1.19.0) were tampered with to include a hidden “MCP addon”.

Once activated, this feature silently downloaded and executed a malicious JavaScript payload (mcpAddon.js) via the Bun runtime.

To evade detection, the attackers utilized Git history manipulation, injecting a backdated, orphaned commit into the official Checkmarx/ast-vscode-extension repository.

The obfuscated 10MB payload functioned as a powerful token stealer, actively targeting:

• GitHub authentication tokens
• AWS, Microsoft Azure, and Google Cloud credentials
• NPM configuration files (.npmrc)
• SSH keys and environment variables

The malware employed sophisticated automated techniques to pivot from compromised local developer environments into broader CI/CD pipelines.

The attackers abused stolen GitHub tokens to create public staging repositories under victim accounts dynamically. These repositories, deceptively labeled “Checkmarx Configuration Storage,” were used to store encrypted exfiltrated data temporarily.

Notably, the repositories followed a distinct naming convention utilizing vocabulary from the Dune universe, such as gesserit-melange-813 and prescient-sandworm-556.

Affected Components Summary

GitHub Actions Secret Theft

Using the compromised tokens, the malware automatically identified writable repositories and injected a malicious GitHub Actions workflow named format-check.yml.

This workflow was designed to dump the repository’s entire secrets context into a text file and upload it as a downloadable artifact for the attackers.

To maximize lateral spread, the malware parsed victims’ .npmrc files to identify the NPM packages they maintained.

It then used the stolen authentication tokens to republish these packages with the malicious payload, propagating the infection across the open-source NPM ecosystem.

The threat group known as TeamPCP has publicly claimed responsibility for the attack on social media. This group is recognized for similar supply chain operations that targeted Trivy and LiteLLM earlier in 2026.

Organizations utilizing Checkmarx KICS must treat this incident as a severe credential breach. Security teams should immediately remove all affected Docker images and VS Code extensions from their build pipelines.

Furthermore, it is critical to aggressively rotate all exposed GitHub tokens, cloud access keys, NPM tokens, and CI/CD secrets while auditing environments for unauthorized public repositories and anomalous GitHub Actions workflows.

IoC

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.