Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions

2026-06-03

Attackers compromised Checkmarx KICS Docker images and VS Code extensions, replacing tags with trojanized binaries and mcpAddon.js that exfiltrated cloud, GitHub, and developer credentials via GitHub repos, Actions workflows, and npm republishing, indicating a multi-stage supply chain attack.