TeamPCP Hits Checkmarx: Inside the cx-dev-assist and KICS Supply Chain Compromise

Supply Chain Attack | Credential Theft | VS Code Extension | Docker Hub | GitHub Actions

On April 22, 2026, Checkmarx disclosed a supply chain security incident affecting several of its publicly distributed artifacts. Malicious versions of KICS Docker images, a GitHub Action, and two VS Code extensions were published during a short window. Checkmarx acted quickly to remove the artifacts and is conducting a forensic investigation with third-party experts.

I reviewed the official advisory and the affected components to help teams respond effectively.

TL;DR

• What: Malicious tags on checkmarx/kics Docker images, ast-github-action 2.3.35, ast-results VS Code extension (2.63, 2.66), and cx-dev-assist (1.17, 1.19).
• Key fact: Previously published safe versions and SHAs were not overwritten. Only users who pulled new tags during the narrow window were potentially impacted.
• Impact: Potential credential harvesting and further compromise if malicious artifacts were used.
• Safe versions per Checkmarx: KICS Docker — latest, v2.1.20, alpine, debian (post-remediation); ast-github-action — v2.3.36; ast-results VS Code — v2.64.0; cx-dev-assist — v1.18.0.

Timeline and Affected Artifacts

The incident occurred on April 22, 2026, with distinct short time windows per artifact.

The full list of malicious KICS SHAs is available in Checkmarx's advisory.

What Checkmarx Has Done

• Removed all malicious artifacts from the affected distribution channels.
• Revoked and rotated exposed credentials.
• Blocked outbound access to attacker infrastructure.
• Initiated a third-party forensic investigation.
• Published a security update for customer transparency.

Recommended Actions (Official)

Checkmarx strongly recommends the following immediate steps.

1. Block these domains and IPs at egress: checkmarx.cx → 91.195.240.123, audit.checkmarx.cx → 94.154.172.43.
2. Use pinned versions and SHAs — review or disable auto-updates in IDEs and CI/CD pipelines.
3. Rotate secrets if you suspect exposure: GitHub tokens, cloud credentials, npm tokens, SSH keys, and anything reachable from a host that ran an affected version.
4. Switch to known safe versions immediately (see TL;DR above).

Detection and Response Checklist

• Audit Docker pulls, GitHub Action usages, and VS Code extensions installed between April 22, 12:00 and 16:00 UTC.
• Scan environments for connections to the blocked domains and IPs.
• Review CI/CD logs and developer workstations for unexpected behavior during the window.
• Monitor the Checkmarx community incident page for updates.

Minimum Release Age Policy

This incident reinforces the value of delaying adoption of newly published versions (7+ days) in production pipelines and IDEs. Short-window attacks depend on speed — a simple aging policy gives the community and vendors time to respond.

Key Takeaways

• Supply chain attacks on security tools remain a real threat.
• Always pin to exact versions or SHAs instead of latest or floating tags.
• Runtime behavior and auto-updates in developer tools require careful governance.
• Rapid vendor transparency helps limit damage.

Update: Campaign Continues — Bitwarden CLI Workflow Incident (April 22–23)

Less than 24 hours after the Checkmarx disclosure, the same campaign impacted Bitwarden. On April 22, 2026 (between approximately 5:57 PM and 7:30 PM ET), a malicious version of @bitwarden/[email protected] was published to npm.

Bitwarden confirmed the issue stemmed from the broader supply chain incident. The malicious package was published via a compromised GitHub Action in their CI/CD pipeline. Bitwarden quickly deprecated the version, contacted npm for removal, and stated that:

• No end-user vault data was accessed or at risk.
• The core Bitwarden codebase, production systems, and signed desktop/mobile apps remain unaffected.
• A CVE is being issued for the malicious CLI version.

Recommended action for Bitwarden users: Anyone who installed or used @bitwarden/[email protected] from npm during that short window should rotate exposed credentials (GitHub tokens, cloud keys, SSH keys, npm tokens, etc.).

This extension of the campaign shows how attackers are chaining compromises — moving from security tooling to widely used developer utilities. It highlights the risk to npm distribution paths and the importance of pinned versions even for trusted open-source projects.

Companion resources: Checkmarx Official Security Update · Bitwarden Community Statement.

The affected Checkmarx artifacts (and now the Bitwarden CLI version) are tracked publicly. Pin your dependencies, monitor for IOCs, and treat developer tooling with extra caution.

Stay secure — verify before trusting latest.