Full Report
Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The
Analysis Summary
# Incident Report: Supply Chain Compromise of Checkmarx KICS Distribution Channels
## Executive Summary
Multiple distribution channels for Checkmarx’s "Keeping Infrastructure as Code Secure" (KICS) tool were compromised by unknown threat actors who injected malicious code into official Docker Hub images and VS Code extensions. The compromised tools were designed to exfiltrate sensitive scan reports—potentially containing credentials and infrastructure secrets—to attacker-controlled endpoints. The incident represents a significant software supply chain attack affecting developers and DevOps teams globally.
## Incident Details
- **Discovery Date:** April 22, 2026
- **Incident Date:** Ongoing/April 2026
- **Affected Organization:** Checkmarx
- **Sector:** Software Development / Cybersecurity
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Preceding April 22, 2026.
- **Vector:** Compromise of Checkmarx’s distribution credentials or CI/CD pipeline (exact mechanism under investigation).
- **Details:** Attackers gained unauthorized access to the official `checkmarx/kics` Docker Hub repository and the Microsoft VS Code Marketplace.
### Lateral Movement
- **Details:** The report focuses on external distribution; however, the attacker moved through Checkmarx’s release infrastructure to overwrite official tags and publish malicious versions of existing tools.
### Data Exfiltration/Impact
- **Details:** Malicious KICS binaries generated uncensored scan reports (including Terraform, Kubernetes, and CloudFormation configurations), encrypted them, and exfiltrated them to a remote endpoint. VS Code extensions also fetched and executed unauthorized remote JavaScript.
### Detection & Response
- **Discovery:** Detected by researchers at the security firm Socket.
- **Response Actions:** The official Docker repository was archived, and malicious versions were identified/removed. Checkmarx was contacted for additional incident investigation.
## Attack Methodology
- **Initial Access:** Distribution channel compromise (Docker Hub and code marketplace).
- **Persistence:** Overwriting existing official tags (e.g., `v2.1.20` and `alpine`) to ensure users pulling standard images received the malicious payload.
- **Defense Evasion:** Removed malicious code in version `1.18.0` of the VS Code extension while maintaining it in `1.17.0` and `1.19.0` to likely evade detection and confuse auditors.
- **Collection:** Automated scanning of Infrastructure-as-Code (IaC) files for credentials.
- **Exfiltration:** Reports were encrypted and sent to a hardcoded external endpoint via the modified KICS binary.
- **Impact:** Malicious code execution via the Bun runtime and data theft of sensitive configuration data.
## Impact Assessment
- **Financial:** Undisclosed; potential costs related to incident response and remediation for both Checkmarx and its customers.
- **Data Breach:** Exposure of highly sensitive IaC files, including secrets, API keys, and cloud configuration details.
- **Operational:** Disruption of CI/CD pipelines as organizations scramble to audit and rotate secrets.
- **Reputational:** High impact; compromise of a trusted security vendor’s own toolset.
## Indicators of Compromise
- **File Indicators:** Modified KICS binary in Docker tags `v2.1.20`, `alpine`, and `v2.1.21`.
- **Behavioral Indicators:** Unscheduled network traffic to external endpoints following a KICS scan; unauthorized use of the Bun runtime by VS Code extensions.
- **Network Indicators:** Hardcoded GitHub URLs fetching external JavaScript addons (defanged: `hxxps[://]github[.]com/[redacted]/[redacted]`).
## Response Actions
- **Containment:** The `checkmarx/kics` Docker Hub repository was archived to prevent further pulls.
- **Eradication:** Identification of malicious VS Code extension versions (`1.17.0`, `1.19.0`).
- **Recovery:** Users advised to treat any secrets scanned by the affected versions as compromised and rotate them immediately.
## Lessons Learned
- **Distribution Integrity:** Relying solely on Docker tags is insufficient; tags can be overwritten. Organizations should use immutable image digests (SHA-256).
- **Supply Chain Trust:** Even tools from security vendors can be compromised; second-party tools require the same level of scrutiny as open-source libraries.
## Recommendations
- **Rotate Secrets:** Any credentials, tokens, or SSH keys stored in Terraform, CloudFormation, or Kubernetes files scanned by affected KICS versions must be invalidated.
- **Implement Content Trust:** Use Docker Content Trust (DCT) or similar signing mechanisms to verify image authenticity.
- **Integrity Verification:** Use checksums/digests for all CI/CD tooling rather than floating version tags.
- **Egress Monitoring:** Monitor and restrict outbound network traffic from build environments and developer workstations.