checkmarx[.]cx

The Bitwarden command-line interface (CLI) NPM package was compromised in a supply chain attack that appears tied to previous campaigns against the open source software (OSS) ecosystem. One of the most popular open source password management platforms, with over 250,000 monthly downloads, Bitwarden allows enterprises to secure authentication with zero-knowledge encryption, password sharing, and policy and credential management. On Thursday, multiple security firms warned that version 2026.4.0 of the Bitwarden CLI’s NPM package contained malicious code to fetch a JavaScript payload designed to steal credentials and secrets from victim machines. The malicious package contained an altered execution path to run a malicious loader, download a Bun archive from GitHub, extract it, and execute the JavaScript payload. The malware contains three collectors targeting secrets and tokens across Azure, AWS, GitHub, GCP, and NPM, as well as SSH material, shell history, and AI tooling configuration and MCP-related files, JFrog explains. Additionally, the payload weaponizes the identified GitHub tokens and abuses GitHub Actions to create repositories in the victims’ accounts, create branches, commit workflow files, and download the resulting artifacts to extract more secret material. The malware attempts to exfiltrate the collected data via HTTPS but switches to GitHub paths if that fails. “The most notable aspect of this package is that it combines a supply chain compromise of a legitimate CLI identity with a broad post-install secret theft framework. Instead of stopping at .npmrc or a single PAT, the malware systematically pivots across local credentials, CI secrets, GitHub repositories, and multiple cloud secret stores,” JFrog notes. Bitwarden confirmed the supply chain hack, but noted that its investigation “found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised”. The Checkmarx attack The Bitwarden CLI compromise is linked to the recent supply chain attack on Checkmarx, which hit the company’s public DockerHub KICS image, public ast-github-action, VS Code extension, and Developer Assist extension. On April 22, Checkmarx confirmed the incident, sharing details on the malicious artifacts associated with the attack and urging users to immediately rotate secrets and credentials if they were affected. The malware used in the attack was designed to harvest credentials and exfiltrate them to the checkmarx[.]cx domain, or to repositories created under the victim’s GitHub account, a pattern used in the Bitwarden supply chain attack as well. Socket’s analysis of the two incidents also revealed the use of the same embedded payload structure, credential harvesting method, propagation technique, and Russian locale kill switch. “The shared tooling strongly suggests a connection to the same malware ecosystem, but the operational signatures differ in ways that complicate attribution,” Socket notes. The TeamPCP and Shai-Hulud connections The complication, the cybersecurity firm explains, comes from the fact that the Checkmarx attack was claimed by TeamPCP, while the Bitwarden incident references the Shai-Hulud worm that crawled through NPM last year. Also known as DeadCatx3, PCPcat, and ShellForce, TeamPCP is a hacking group active since at least 2024 that has been focusing on supply chain attacks for the past year. The hacking group made headlines over the past month after it compromised Aqua Security’s Trivy vulnerability scanner to steal secrets and pivot across the OSS ecosystem and beyond. As Socket notes, TeamPCP apparently claimed responsibility for the Checkmarx incident on social media, which did not come as a surprise, as it had hit the company’s GitHub Actions and OpenVSX plugins as part of the March campaign. However, the Bitwarden payload contains the “Shai-Hulud: The Third Coming” string, suggesting that the incident represents the latest phase of the previous campaign, OX Security says. Terms such as atreides, fremen, sandworm, and sardaukar were also found in the code, which points to a possible overlap with the Shai-Hulud campaigns, but it does not definitely link TeamPCP to the previous attacks, JFrog notes. Shai-Hulud first emerged in the NPM registry in September, when it spread to more than 180 packages using stolen developer credentials. During a second wave in November, it infected over 640 packages. “User data is being publicly exfiltrated to GitHub, often going undetected because security tools typically don’t flag data being sent there. This makes the risk significantly more dangerous: anyone searching GitHub can potentially find and access those credentials. At that point, sensitive data is no longer in the hands of a single threat actor; it’s exposed to anyone,” said OX Security team lead Moshe Ben Siman Tov. Related: ‘By Design’ Flaw in MCP Could Enable Widespread AI Supply Chain Attacks Related: OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack Related: European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack

Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The Docker repository has been archived as of writing. "Analysis of the poisoned image indicates that the bundled KICS binary was modified to include data collection and exfiltration capabilities not present in the legitimate version," Socket said. "The malware could generate an uncensored scan report, encrypt it, and send it to an external endpoint, creating a serious risk for teams using KICS to scan infrastructure-as-code files that may contain credentials or other sensitive configuration data." Further analysis of the incident has uncovered that related Checkmarx developer tooling may also have been affected, such as recent Microsoft Visual Studio Code extension releases that come with malicious code to download and run a remote addon through the Bun runtime. "The behavior appeared in versions 1.17.0 and 1.19.0, was removed in 1.18.0, and relied on a hard-coded GitHub URL to fetch and run additional JavaScript without user confirmation or integrity verification," Socket added. The list of affected extensions is below - checkmarx/[email protected] checkmarx/[email protected] checkmarx/[email protected] checkmarx/[email protected] Specifically, the compromised Checkmarx extensions come with a multi-stage credential theft and propagation component that, upon extension activation, is downloaded from a GitHub URL as "mcpAddon.js." The file name implies an attempt to masquerade the malware as a hidden Model Context Protocol (MCP) feature. "The attacker began by injecting a backdated commit (68ed490b) into the 'Checkmarx/ast-vscode-extension' repository," Socket said. "This commit was deliberately crafted to appear legitimate: it was spoofed to look like it was authored in 2022, attached to a real commit as its parent, and given a benign-looking change. However, it introduced a large (~10MB) file, modules/mcpAddon.js." It comes with capabilities to harvest developer and cloud credentials, compress and encrypt the results, and transmit them to a threat actor-created public GitHub repository created within victim accounts using stolen GitHub access tokens. The list of captured data is as follows - Github Auth tokens Amazon Web Services (AWS) credentials Microsoft Azure authentication tokens Google Cloud credential databases NPM configuration files SSH keys and configuration files Environment variables Claude and other MCP configuration files Besides staging the exfiltration artifacts in public GitHub repositories as JSON files, the attack chain is engineered to send the tokens and secrets to an HTTPS endpoint under the threat actor's control: "audit.checkmarx[.]cx/v1/telemetry." As of writing, there are 51 repositories with the distinct phrase "Checkmarx Configuration Storage" in the README files. As for the compromised Docker images, they have been found to bundle an ELF binary written in Golang named "kics" in an attempt to mimic the KICS scanner. In reality, it contains malicious functionality to gather sensitive data and send it to the same command-and-control server address as "mcpAddon.js." Interestingly, the created repository follows a consistent naming pattern: " - - ." Some of the identified repositories are listed below. The first such repository was created on April 22, 2026, at 1:48 p.m. UTC. gesserit-melange-813 atreides-heighliner-520 prescient-sandworm-556 prana-melange-944 "It also abuses stolen GitHub tokens to inject a new GitHub Actions workflow that captures secrets available to the workflow run as an artifact, and uses stolen npm credentials to identify writable packages for downstream republishing," the company explained. "In effect, the operation was designed not just to steal data from infected environments, but to turn compromised developer and CI/CD access into new exfiltration and supply chain propagation paths." The malware performs repository discovery, targets those that have configured GitHub Actions secrets, and then creates a new branch for each of them, followed by injecting the rogue workflow (".github/workflows/format-check.yml") to extract CI/CD secrets when it's triggered automatically on push events. Once the workflow is run, the branch and the workflow run are deleted to conceal traces of malicious activity. In the final stage, the attack shifts to a worm-like npm ecosystem propagation, abusing the victim's npm credentials to extract 250 packages maintained by them and republish each of those packages with the malicious payload to further spread the malware. Organizations that may have used the affected KICS image to scan Terraform, CloudFormation, or Kubernetes configurations should treat any secrets or credentials exposed to those scans as likely compromised. "The evidence suggests this is not an isolated Docker Hub incident, but part of a broader supply chain compromise affecting multiple Checkmarx distribution channels," the company noted. Evidence suggests that the threat actor known as TeamPCP may be behind the supply chain compromise. "Thank you OSS distribution for another very successful day at PCP inc.," TeamPCP wrote in an X post shortly after details of the incident became public knowledge. If this is indeed the case, the development marks the second time Checkmarx has been targeted by TeamPCP in as many months. In March 2026, the group compromised two of Checkmarx's GitHub Actions workflows ("ast-github-action" and "kics-github-action") to push a credential stealer. The incident was part of a broader supply chain attack that also hit Trivy, LiteLLM, and Telnyx. It's currently not known how the Checkmarx compromise occurred, and if the attackers had lingering access to Checkmarx's environment following last month's incident. "Technical evidence shows the attacker had write access to Checkmarx repos between March and April, but we cannot determine from artifacts alone whether this was retained access, re-compromise, or unremediated credentials," Socket told The Hacker News. "The orphaned commit technique suggests sustained repo access." To mitigate the threat, developers who have pulled the affected Checkmarx artifacts should assume compromise and take the following steps - Immediately remove the affected extensions, actions, and container images from developer systems and build environments. Rotate any exposed credentials, including GitHub tokens, npm tokens, cloud credentials, SSH keys, and CI/CD secrets. Review GitHub for unauthorized repository creation and suspicious workflows. Audit npm for unauthorized publication of packages. Review access logs for unusual secret access, token use, and newly issued credentials in cloud environments. In a statement posted on its site, Checkmarx said it's actively investigating the security incident and that it did not affect customers using versions or SHAs published prior to the affected timeframes. The following artifacts have been identified as potentially affected - Checkmarx/kics (Docker image) - v2.1.20-debian, v2.1.21-debian, debian, v2.1.21, v2.1.20, alpine, v2.1.20, v2.1.21, latest (Safe version: latest, v2.1.20, alpine, debian) Checkmarx/ast-github-action (GitHub Actions workflow) - 2.3.35 (Safe version: 2.3.36) ast-results (VS Code extension) - 2.63, 2.66 (Safe version: 2.64.0) cx-dev-assist (VS Code extension) - 1.17, 1.19 (Safe version: 1.18.0) Checkmarx is also urging customers to block access to the "audit.checkmarx[.]cx" (IP address: 94.154.172[.]43) and "checkmarx[.]cx" (IP address: 91.195.240[.]123) domains, use pinned SHAs, rotate secrets and credentials if a compromise is detected, and use only safe versions of the aforementioned artifacts. "To date, we have removed the malicious artifacts, revoked and rotated exposed credentials, blocked outbound access to attacker-controlled infrastructure, reviewed our environments for any signs of further compromise," Checkmarx told The Hacker News.