Checkmarx KICS supply chain pushes credential-stealing code via Docker and IDE

TL;DR - Attackers pushed malicious artifacts into Checkmarx's official Docker Hub repository, GitHub Action, and IDE extensions on April 22, 2026. The payload stole GitHub tokens, cloud credentials, SSH keys, and environment variables, exfiltrating them to attacker-controlled infrastructure. If you pulled any of the affected tags during the windows listed below, treat all secrets accessible to those jobs or machines as compromised.

What happened

KICS (Keeping Infrastructure as Code Secure) is Checkmarx's open-source IaC scanner. Teams run it in CI pipelines via Docker images and GitHub Actions to scan Terraform, Kubernetes manifests, and other infrastructure definitions. It runs with access to the same environment secrets your build jobs carry.

BleepingComputer reported that on April 22, attackers pushed malicious artifacts across multiple Checkmarx distribution channels: the official checkmarx/kics Docker Hub repository, the checkmarx/ast-github-action, and Checkmarx IDE extensions for VS Code and Open VSX.

Checkmarx's incident update, dated April 22, 2026, states the malicious artifacts were time-bounded and did not overwrite previously published known-safe versions. According to that update, Checkmarx removed the malicious artifacts, revoked and rotated exposed credentials, blocked outbound access to attacker-controlled infrastructure, reviewed environments for further signs of compromise, and initiated a third-party forensic investigation.

The malicious payload involved a hidden "MCP addon" feature that harvested GitHub tokens, cloud credentials, npm tokens, SSH keys, and environment variables, then exfiltrated them to infrastructure including audit.checkmarx[.]cx.

This is the worst-case shape for a platform supply-chain attack. Mutable tags and auto-updating IDE plugins place credential-stealing code directly inside CI runners and developer workstations - exactly where broad secret access lives.

Who is impacted

• Teams that pulled Checkmarx artifacts during the affected windows, particularly in CI where KICS and AST runs have access to cloud credentials, GitHub tokens, and other build secrets.
• Developers with auto-update enabled for Checkmarx IDE marketplace extensions.

What to do now

• Block attacker-controlled infrastructure immediately. Checkmarx listed the following domains and IPs:
  • checkmarx.cx => 91[.]195[.]240[.]123
  • audit.checkmarx.cx => 94[.]154[.]172[.]43
• Pin image references to SHAs rather than mutable tags. Review or disable auto-update settings in IDE marketplaces.
• Inventory your exposure across every CI job and developer machine:
  • Identify any jobs that pulled the affected Docker tags during the windows above.
  • Identify any workflows that used checkmarx/[email protected] during the same period.
  • Enumerate installed Checkmarx IDE extensions and confirm whether installed versions match the affected tags.
• Move to the known-safe versions Checkmarx identified:
  • checkmarx/kics Docker image: latest, v2.1.20, alpine, debian
  • checkmarx/ast-github-action: v2.3.36
  • Checkmarx VS Code extensions: v2.67.0
  • Checkmarx Developer Assist extension: v1.18.0
• Rotate secrets broadly if any affected artifact ran in your environment. Scope this like a CI credential exposure event: review workflow run logs and audit trails around the affected windows, then rotate every credential available to those jobs - cloud keys, GitHub tokens, npm tokens, SSH keys, and any environment variables present at build time.

Why this matters for AppSec

Mutable container tags and auto-updating IDE plugins are trust assumptions that most teams never consciously make - but they do, every time a CI job runs docker pull checkmarx/kics:latest or a developer's editor silently installs an update.

This incident makes the threat model concrete:

1. Mutable tags are implicit trust delegation. When you pin to latest or a named tag rather than a digest, you're trusting whoever controls that registry path in perpetuity.
2. CI runners are high-value targets. A scanner that runs across your IaC has access to the same secrets as your deployment pipeline. That's a significant blast radius.
3. IDE extensions are an underguarded surface. Auto-update in a marketplace means your developer workstation is also a pull-based deployment target. Developers carry database credentials, cloud keys, and personal access tokens.
4. Time-bounded attacks are hard to detect. A 28-minute window on a Docker tag leaves a narrow detection surface unless you're logging image digests at pull time.

The short-term fix is rotating secrets. The longer-term fix is pinning every third-party tool to a digest and auditing that list regularly.