Hackers have compromised Docker images, VSCode and Open VSX extensions for the Checkmarx KICS analysis tool to harvest sensitive data from developer environments. KICS, short for Keeping Infrastructure as Code Secure, is a free, open-source scanner that helps developers identify security vulnerabilities in source code, dependencies, and configuration files. The tool is typically run locally via CLI or Docker, and processes sensitive infrastructure configs that often contain credentials, tokens, and internal architecture details. Dependency security company Socket investigated the incident after receiving an alert from Docker about malicious images pushed to the official checkmarx/kics Docker Hub repository. The investigation revealed that the compromise extended beyond the trojanized KICS…