This threat involves a supply chain attack targeting Checkmarx KICS distribution channels via poisoned official Docker Hub images and VS Code extensions. The malicious artifacts enable unauthorized data exfiltration by collecting credentials from infrastructure-as-code scan reports and developer environments. The malware leverages the Bun runtime to download additional malicious scripts that harvest a wide range of credentials including GitHub tokens, cloud service tokens, npm credentials, and SSH keys. It further propagates by creating public GitHub repositories to stage stolen data and injecting malicious GitHub Actions workflows to capture secrets from repositories. The attack also attempts to propagate through npm packages using stolen credentials. The adversary identified is TeamPCP, and the attack is designed to compromise CI/CD pipelines and developer environments.

The compromise results in unauthorized exfiltration of sensitive credentials including GitHub tokens, AWS and Azure tokens, npm credentials, and SSH keys. This can lead to further compromise of developer environments, CI/CD pipelines, and cloud resources. The malware's ability to create public repositories and inject malicious workflows increases the risk of widespread credential theft and propagation within software supply chains. The attack undermines trust in official Checkmarx KICS Docker images and VS Code extensions, potentially impacting organizations relying on these tools for infrastructure-as-code security scanning.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or updates are released, users should avoid using the affected Docker image tags (v2.1.20, v2.1.21, alpine) and VS Code extension versions (1.17.0, 1.19.0). Verify the integrity of downloaded artifacts and consider reverting to known clean versions if available. Monitor for suspicious activity related to credential usage and GitHub repository creations. Remove any compromised credentials and rotate secrets that may have been exposed. Follow updates from Checkmarx and trusted security sources for official remediation steps.