Attackers Target Checkmarx KICS Ecosystem

UPDATE: Yet another supply chain attack has hit the open source ecosystem, this time impacting the Checkmarx KICS Docker Hub repository. On April 23, researchers said they had discovered the Bitwarden CLI was compromised on April 22 as part of the ongoing supply chain attack.

Socket on Wednesday said that it was alerted by Docker to malicious images that were pushed to the official checkmarx/kics Docker Hub repository, which was flagged due to suspicious new KICS image tags. KICS (Keeping Infrastructure as Code Secure) is an open source initiative by Checkmarx that’s designed to find security issues (like flaws and misconfigurations) early in the development lifecycle. 

“Our investigation found that attackers appear to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to a legitimate upstream release,” according to Socket in an analysis. “Analysis of the poisoned image indicates that the bundled KICS binary was modified to include data collection and exfiltration capabilities not present in the legitimate version.”

Since then, multiple checkmarx/kics tags were updated to point to the malicious digest and have since been restored to the prior legitimate release. The impacted tags included v2.1.20-debian, v2.1.20, debian, and alpine. Meanwhile, the v2.1.21 tag has since been deleted.

On April 23, password manager Bitwarden acknowledged that it was impacted by the supply chain attack, saying that a malicious package was distributed through the npm delivery path for @bitwarden/cli@2026.4.0 between 5:57pm and 7:30pm ET on April 22.

"The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised," according to Bitwarden in a statement. "Once the issue was detected, compromised access was revoked, the malicious npm release was deprecated, and remediation steps were initiated immediately."

Researchers said they found that the bundled KICS binary had been modified in order to include data collection and exfiltration functionalities that weren’t present in the actual version. 

“Our investigation found evidence that the malware could generate an uncensored scan report, encrypt it, and send it to an external endpoint, creating a serious risk for teams using KICS to scan infrastructure-as-code files that may contain credentials or other sensitive configuration data,” according to Socket. 

As Socket researchers continued their investigation, the scope of the incident appeared to widen outside of the malicious KICS image. They found evidence that related Checkmarx developer tooling may have also been impacted, including recent releases of VS Code/ Open VSX extensions that were used to deliver a second-stage payload, identified as mcpAddon.js.

This payload was downloaded from a hardcoded GitHub URL pinned to a specific commit within Checkmarx’s own repository and executed using the Bun runtime. Analysis revealed that this behavior was present in versions 1.17.0 and 1.19.0, absent in version 1.18.0, and depended on the hardcoded GitHub URL to retrieve and run additional JavaScript (sans user confirmation). The malware was designed to harvest a wide range of sensitive credentials, including those associated with GitHub, AWS, Azure, Google Cloud, npm, SSH, environment variables, and MCP-related data. Researchers also determined that stolen GitHub tokens were leveraged to create public repositories used to stage exfiltrated data, while malicious GitHub Actions workflows were injected to capture additional repository secrets.

In addition, compromised npm credentials were used to identify packages with write access, enabling potential downstream propagation of the attack. The threat actor group known as TeamPCP has reportedly taken public credit for the operation. The group had previously targeted Checkmarx KICS GitHub Actions and OpenVSX extensions via an attack on the open source vulnerability scanner Aqua Trivy.

This incident is only the latest in a string of recent supply chain attacks afflicting the open source ecosystem, with the most notable occurring at the end of March and impacting axios npm packages. 

This post was updated on April 23 with an update that the incident now impacts Bitwarden CLI.