# Checkmarx KICS Docker images + Open VSX extensions compromised (TeamPCP)

> Docker and Socket jointly disclosed a multi-stage compromise of Checkmarx KICS Docker images and Checkmarx VS Code / Open VSX extensions. Trojanised extensions silently install an MCP addon executed via Bun, while the Docker images include a modified KICS binary that encrypts scan output and exfiltrates it. TeamPCP claimed responsibility.

- Published: 2026-04-22
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: Docker, Open VSX
- Scope: 3 packages, 11 compromised versions
- Tags: ci-cd-compromise, credential-theft, maintainer-takeover
- Threat actor: TeamPCP
- Detected by: Socket, Docker
- Incident ID: multi-2026-04-22-checkmarx-kics-vsx-docker

## Affected packages (3)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [checkmarx.ast-results](https://dependencywatch.io/package/openvsx/checkmarx.ast-results) | Open VSX | 2.63.0, 2.66.0 |
| [checkmarx.cx-dev-assist](https://dependencywatch.io/package/openvsx/checkmarx.cx-dev-assist) | Open VSX | 1.17.0, 1.19.0 |
| [checkmarx/kics](https://dependencywatch.io/package/docker/checkmarx/kics) | Docker | 2.1.20, 2.1.20-debian, 2.1.21, 2.1.21-debian, alpine, debian, latest |

## What happened

Docker and Socket jointly disclosed a coordinated April 22, 2026 compromise of the Checkmarx security-tooling supply chain. Two surfaces were hit: the `checkmarx/kics` Docker images on Docker Hub and the `cx-dev-assist` + `ast-results` extensions on Open VSX (the open Visual Studio Code marketplace).

The Open VSX extensions silently install a Model Context Protocol (MCP) addon executed via the Bun runtime. The addon reads developer credentials and editor state, harvesting GitHub / AWS / Azure / npm tokens and SSH keys from extension users and feeding them to the same `audit.checkmarx.cx` exfil endpoint used in the parallel `@bitwarden/cli` push (see `npm-2026-04-22-bitwarden-cli-teampcp`).

The Docker images carry a modified KICS scanner binary. KICS is a configuration-as-code scanner widely used in CI; the trojanised version encrypts and exfiltrates scan output, so any pipeline that mounted infrastructure code into the KICS scan leaked findings and secret material to the attacker.

TeamPCP publicly claimed responsibility for this push. The cross-surface design - editor extension + Docker image + downstream `@bitwarden/cli` hijack via Checkmarx GitHub Actions - makes this one of the most impactful coordinated supply-chain operations of 2026 so far. Revert any affected extension or image to the last known-clean release, rotate developer and CI credentials in affected scopes, and block `audit.checkmarx.cx` at egress.

## Impact

- GitHub/AWS/Azure/npm tokens and SSH keys harvested from extension users
- KICS scans in CI pipelines exfiltrated secrets and code findings
- Editor-level RCE on developer workstations

## What to do

1. Remove listed Checkmarx extension versions and Docker images
2. Revert to last known-clean releases of `cx-dev-assist` and `ast-results`
3. Rotate developer and CI credentials in affected scopes
4. Block `audit.checkmarx.cx` at egress

## References

- [Socket: Checkmarx supply-chain compromise](https://socket.dev/blog/checkmarx-supply-chain-compromise) - Socket
- [JFrog: Bitwarden CLI hijack via Checkmarx](https://research.jfrog.com/post/bitwarden-cli-hijack/) - JFrog

---

Canonical page: https://dependencywatch.io/incident/multi-2026-04-22-checkmarx-kics-vsx-docker
Markdown version: https://dependencywatch.io/incident/multi-2026-04-22-checkmarx-kics-vsx-docker.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).