> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # Checkmarx Attack Weaponizes KICS and Bitwarden CLI - URL: https://www.thecybersignal.com/checkmarx-attack-weaponizes-kics-and-bitwarden-cli/ - Published: 2026-04-24T12:13:00.000Z - Updated: 2026-07-15T11:16:03.000Z - Author: Nicholas Robert - Tags: Supply Chain Attack, Vulnerability Management, DevSecOps, CI/CD Security, Trending *Malicious Docker images and VS Code extensions steal IaC secrets; Bitwarden npm trusted publishing abused in a sophisticated DevSecOps attack chain.* **TEL AVIV, IL** — In a cascading security failure that strikes at the heart of modern DevSecOps, the prominent security vendor **Checkmarx** has confirmed a multi-stage supply chain compromise affecting its flagship open-source scanner, **KICS**, and its official VS Code extensions. The breach, claimed by an actor identified as **TeamPCP**, further metastasized on April 22 when a compromised Checkmarx GitHub token was used to poison the official **Bitwarden CLI** npm package. The incident represents a nightmare scenario for enterprise security teams: the very tools used to scan for vulnerabilities were weaponized to exfiltrate them. --- ## Breach Audit: The KICS-to-Bitwarden Attack Chain The infection began with the compromise of the **checkmarx/kics** Docker repository. Attackers injected malicious code into specific tags — primarily **v2.1.20**, **v2.1.21**, and the **alpine** variant. Simultaneously, Checkmarx's VS Code extensions (v1.17.0 and v1.19.0) were updated to download a remote JavaScript file, `mcpAddon.js`, via the Bun runtime to establish C2 communication. The attack reached its peak between 5:57 PM and 7:30 PM ET on April 22, when the **@bitwarden/cli@2026.4.0** package was published to npm. The attackers bypassed traditional barriers by exploiting **npm trusted publishing**, using a stolen GitHub token from a Checkmarx automated workflow to push the malicious version to Bitwarden’s official distribution path. For a full list of C2 domains and malicious file hashes discovered during this audit, see the **Indicators of Compromise** in our technical breakdown below. ## **Strategic Defense: Mitigation & Remediation** To secure your environment against the **TeamPCP** attack chain, organizations must execute the following mandatory steps. Because this breach involves the exfiltration of high-value secrets, simple patching is insufficient; a comprehensive credential reset is required. | Mandatory Remediation: Safe Baseline | | | ------------------------------------ | -------------------------------------------------------- | | Tooling | Safe Version / Action Required | | Bitwarden CLI | Install 2026.4.1; Uninstall 2026.4.0 immediately. | | KICS Docker | Pin to v2.1.19; Avoid v2.1.20, v2.1.21, alpine. | | VS Code Extension | Clean reinstall; Ensure version is not 1.17.0 or 1.19.0. | ### **1\. Critical Software Remediation** - **Checkmarx KICS:** Purge all cached Docker images. Specifically, avoid and delete tags `v2.1.20`, `v2.1.21`, `alpine`, and `latest`. Pin your CI/CD pipelines to a known clean version like `v2.1.19` until a verified `v2.1.22+` release is deployed. - **Bitwarden CLI:** If you updated via **npm** on April 22, 2026, you may have the compromised package. Downgrade from `@bitwarden/cli@2026.4.0` immediately. The verified clean version is `2026.4.1`. - **VS Code Extensions:** Uninstall the Checkmarx extension and perform a clean reinstall. Ensure your current version is not `1.17.0` or `1.19.0`. Version `1.18.0` is currently cited as the stable baseline. ### **2\. Credential & Secret Rotation (Mandatory)** - **Revoke GitHub PATs:** Any Personal Access Token (PAT) used in a pipeline where the compromised KICS Docker image was active must be considered stolen. **Revoke and rotate these immediately.** - **Rotate Infrastructure Secrets:** Because KICS is an Infrastructure-as-Code (IaC) scanner, it likely had access to your Terraform states and Kubernetes manifests. Assume all AWS/Azure keys, database credentials, and API secrets within those files have been exfiltrated. ### **3\. Network & Repository Auditing** - **Block C2 Traffic:** Ensure your egress filters block all traffic to the malicious telemetry endpoint: `audit.checkmarx[.]cx`. - **Audit GitHub Repositories:** Scan your organization’s GitHub history for any unexpected repositories or branches created with the name "**Checkmarx Configuration Storage**." These serve as indicators of persistent backdoors. ## **Technical Breakdown: The OIDC Exploitation Loop** This incident highlights a critical vulnerability in the industry's shift toward **Trusted Publishing** (OIDC). By compromising a developer's identity rather than a static password, the attackers effectively turned a "secure" automated flow into an unvetted pipeline for malware. | Incident Response: Indicators of Compromise (IoCs) | | | -------------------------------------------------- | ------------------------------------------------------- | | Category | Detail | | Network C2 | audit.checkmarx\[.\]cx/v1/telemetry (IP: 94.154.172.43) | | Malicious Files | mcpAddon.js, bw\_setup.js, bw1.js (Credential stealers) | | GitHub Indicators | Repos with "Checkmarx Configuration Storage" in README. | --- ## The CyberSignal Analysis ### Signal 01 — The Trusted Publishing Trap The Bitwarden CLI compromise is a watershed moment for npm’s "Trusted Publishing" (OIDC) model. While intended to eliminate long-lived secrets, this incident proves that if an attacker compromises the **identity** (the GitHub Actions runner), the "trusted" automated flow becomes an unvetted pipeline for malware. ### Signal 02 — IaC as an Exploitation Engine Infrastructure-as-Code (IaC) scanners like KICS are inherently "noisy" and require deep access to secrets (Terraform states, Kubernetes configs). By poisoning the scanner, TeamPCP turned a standard security best practice into a systematic data exfiltration engine. This incident echoes the [vulnerability challenges faced by Citizens Financial](https://www.thecybersignal.com/vendor-vulnerability-citizens-financial-manages-data-incident-amid-everest-ransomware-claims/) and other large institutions where third-party vendor trust remains the primary attack surface. --- ## Sources | Type | Source | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Vendor Update | [Checkmarx: April 22 Security Update](https://checkmarx.com/blog/checkmarx-security-update-april-22/?ref=thecybersignal.com) | | Technical Intel | [Socket: Multi-Stage Attack Breakdown](https://socket.dev/blog/checkmarx-supply-chain-compromise?ref=thecybersignal.com) | | Incident Log | [BleepingComputer: Bitwarden & KICS Impact](https://www.bleepingcomputer.com/news/security/new-checkmarx-supply-chain-breach-affects-kics-analysis-tool/?ref=thecybersignal.com) | | Community Alert | [Bitwarden: Official Statement](https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127?ref=thecybersignal.com) | | Technical News | [THN: Ongoing Bitwarden CLI Compromise](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html?ref=thecybersignal.com) |