Listen to this Post
Introduction: When Trusted Tools Turn Against You
Modern development relies heavily on trust. Developers pull images, install extensions, and integrate tools assuming they are safe because they come from verified sources. That trust was seriously shaken when a major supply chain attack targeted Checkmarx KICS, a widely used Infrastructure as Code security tool. What makes this incident particularly alarming is not just the technical sophistication, but the fact that the attackers infiltrated official distribution channels, turning legitimate tools into silent data exfiltration mechanisms.
This breach serves as a stark reminder that even trusted ecosystems like Docker Hub and developer extensions can become attack vectors. As organizations increasingly automate and scale their cloud infrastructure, the consequences of compromised tooling grow exponentially.
The Discovery: A Silent Compromise Uncovered
The attack came to light on April 22, 2026, when researchers from Docker and Socket identified unusual activity within the official Checkmarx KICS Docker repository. What they found was far from a minor anomaly. Threat actors had successfully injected malicious Docker images into the trusted repository, effectively replacing legitimate versions without immediate detection.
These malicious images overwrote widely used tags such as v2.1.20, alpine, debian, and latest. To make matters worse, attackers introduced a fake version labeled v2.1.21, which did not exist in the official release pipeline. This subtle manipulation made it extremely difficult for developers to distinguish between legitimate and compromised versions.
Trojanized Docker Images: A Hidden Data Pipeline
At the core of the attack was a modified Golang binary embedded within the compromised Docker images. Instead of performing standard Infrastructure as Code scans, this altered binary behaved maliciously while appearing functional.
Rather than simply analyzing configurations, the tool generated uncensored scan reports, encrypted them, and transmitted the data to an attacker-controlled endpoint. The destination, masked as a telemetry service, allowed attackers to collect sensitive infrastructure details without raising immediate suspicion.
This approach effectively turned a security tool into a surveillance mechanism, extracting cloud configurations, secrets, and internal architecture insights directly from developer environments.
Exfiltration Infrastructure: Where the Data Went
The attackers used a domain designed to appear legitimate: audit.checkmarx.cx/v1/telemetry. By mimicking expected telemetry behavior, the malicious software avoided triggering alarms that might otherwise detect unusual outbound traffic.
This tactic highlights a growing trend in cyberattacks where adversaries blend malicious activity into normal operational patterns. Instead of brute force or obvious exploitation, they rely on stealth and legitimacy.
Compromised Developer Tools: VS Code Extension Manipulation
The attack did not stop at Docker images. It extended into developer environments through compromised Checkmarx VS Code extensions. Specifically, versions 1.17.0 and 1.19.0 of the ast-vscode-extension were found to be tampered with.
Within these extensions, attackers embedded a hidden feature labeled “MCP addon.” This component quietly downloaded a malicious JavaScript payload called mcpAddon.js using the Bun runtime.
This multi-layered attack strategy ensured persistence across different parts of the development workflow, increasing the chances of widespread compromise.
The Payload: A Full-Scale Credential Harvester
The mcpAddon.js payload was far from simple malware. At approximately 10MB in size, it was designed as a comprehensive credential-stealing tool.
It targeted a wide range of sensitive data, including GitHub tokens, cloud provider credentials from AWS, Azure, and Google Cloud, SSH keys, environment variables, and even NPM configuration files.
By harvesting this data, attackers gained the ability to move laterally across systems, access repositories, and potentially deploy further malicious code.
GitHub Abuse: Turning Victim Accounts into Storage
One of the more unusual aspects of the attack was how stolen data was stored. Instead of sending all data to centralized servers, attackers used compromised GitHub accounts to create temporary public repositories.
These repositories followed a distinct naming convention inspired by the Dune universe, such as “gesserit-melange-813.” Within these repos, exfiltrated data was stored before being retrieved by the attackers.
This technique allowed them to leverage a trusted platform as part of their infrastructure, making detection even more challenging.
Malicious GitHub Actions: Automating the Breach
The attackers also injected a malicious GitHub Actions workflow named format-check.yml into writable repositories. This workflow was designed to extract repository secrets and upload them as downloadable artifacts.
Because GitHub Actions are widely used for automation, this tactic ensured that even private repositories could unknowingly leak sensitive data during routine operations.
This automation layer amplified the scale and impact of the attack.
NPM Ecosystem Impact: Expanding the Blast Radius
Using stolen credentials, the attackers republished compromised NPM packages. This allowed the malware to spread beyond the initial infection points and into a broader ecosystem of JavaScript applications.
By targeting package registries, the attackers ensured that even developers who did not directly use KICS could be affected indirectly through dependencies.
This demonstrates how interconnected modern development environments have become, and how a single compromise can cascade across multiple ecosystems.
Evasion Techniques: Hiding in Plain Sight
To avoid detection, the attackers manipulated Git history by inserting a backdated orphan commit into the official repository. This made the malicious changes appear older and less suspicious during casual inspection.
Such techniques show a deep understanding of developer workflows and auditing practices. Instead of avoiding detection entirely, the attackers focused on blending in.
Indicators of Compromise: Traces Left Behind
Despite the sophistication, the attack left identifiable indicators. These include a malicious IP address, a specific SHA256 hash, a known commit identifier, and the presence of a suspicious GitHub Actions workflow.
These indicators provide a starting point for organizations to investigate potential exposure and mitigate damage.
Threat Actor: A Pattern of Supply Chain Attacks
The group known as TeamPCP has claimed responsibility for this attack. This is not an isolated incident, as the group has previously targeted other developer tools like Trivy and LiteLLM.
Their consistent focus on supply chain attacks suggests a strategic objective: compromising widely used tools to maximize impact.
Immediate Response: What Organizations Must Do
Organizations using Checkmarx KICS are advised to act immediately. This includes removing affected Docker images and VS Code extensions, rotating all credentials, auditing repositories for unauthorized changes, and monitoring NPM dependencies for suspicious activity.
These steps are critical to containing the damage and preventing further exploitation.
What Undercode Say: A Wake-Up Call for Developer Security
The Checkmarx KICS incident is not just another breach. It is a clear signal that the battlefield has shifted toward developer ecosystems. Attackers are no longer focusing solely on production systems. Instead, they are targeting the tools used to build those systems.
This shift is strategic. By compromising development tools, attackers gain access earlier in the lifecycle, where security controls are often weaker. It also allows them to inject malicious behavior into code before it even reaches production.
Another key takeaway is the importance of verification. Blindly trusting official repositories is no longer sufficient. Organizations must implement additional layers of validation, such as image signing, checksum verification, and behavioral monitoring.
The use of legitimate platforms like GitHub for data exfiltration is particularly concerning. It shows that attackers are adapting to detection mechanisms by hiding within trusted services. This makes traditional security approaches less effective.
The multi-vector nature of the attack also stands out. By combining Docker images, VS Code extensions, GitHub workflows, and NPM packages, the attackers created a highly resilient and scalable operation. Even if one vector is detected, others may continue to operate.
This incident also highlights the growing importance of securing CI/CD pipelines. Automated workflows are powerful, but they can also become powerful attack tools if compromised. Organizations must treat CI/CD security as a top priority.
Finally, the psychological aspect cannot be ignored. Attacks like this erode trust in the tools developers rely on daily. Rebuilding that trust will require not just technical fixes, but also transparency and improved security practices across the industry.
Fact Checker Results
✅ The attack did involve compromised Docker images and fake version tags within the official repository.
✅ Credential theft targeted GitHub tokens, cloud credentials, and developer environment secrets.
❌ There is no confirmed evidence yet that all affected organizations experienced full infrastructure breaches.
Prediction
🔮 Supply chain attacks targeting developer tools will increase significantly over the next 2 years.
🔮 Platforms like Docker Hub and NPM will introduce stricter verification and signing requirements.
🔮 Organizations will shift toward zero-trust models even within development environments.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
