Tampered Checkmarx developer tools distribute info-stealing malware
Checkmarx KICS Docker images and VS Code and Open VSX extensions were tampered with to distribute malware that collects secrets from development environments. The attack code was designed to steal cloud credentials, GitHub and npm tokens, SSH keys and more, and the company confirmed that data had been stolen. Malicious versions were later also distributed for the Jenkins AST plug-in, and the company advised users to use safe versions and released a new plug-in.
Key facts
- Affected organisation
- Checkmarx
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Data theft and distribution of malicious versions of developer tools
- Cause / method
- Supply chain attack that tampered with developer tool images, extensions and plug-ins
- Location
- Other countries
Timeline
- The distribution of info-stealing malware through tampered KICS Docker images and VS Code and Open VSX extensions was reported.
- Checkmarx investigated a dark web data leak following the supply chain attack.
- Checkmarx confirmed that data had been stolen in the supply chain attack.
- In response to the distribution of malicious versions of the Jenkins AST plug-in, Checkmarx advised users to use safe versions and released a new plug-in.
Also affected by this incident
Bitwarden CLI npm distribution compromised, malicious version released
↳ Knock-on damage from the Checkmarx incident · View original incidentImpact: Malicious version 2026.4.0 briefly distributed
The npm distribution channel for the Bitwarden CLI was compromised, and a malicious version, 2026.4.0, was briefly distributed. The version included functionality to steal developer credentials and infect additional packages. Bitwarden confirmed the incident was linked to a compromise of Checkmarx-related developer tools and said there was no evidence that password vault data had been compromised.
Read on BleepingComputer ↗
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.