Threat Type: Software Supply Chain Compromise

Severity: Critical

Affected Platforms: npm, Docker Hub, Open VSX / VS Code Marketplace, GitHub Actions CI/CD pipelines

Affected Components: Checkmarx KICS Docker images (v2.1.20, v2.1.21, alpine, debian, latest), Checkmarx VS Code extensions (cx-dev-assist 1.17.0 / 1.19.0, ast-results 2.63.0 / 2.66.0), Bitwarden CLI (@bitwarden/[email protected])

Attack Chain (Checkmarx KICS and VS Code Extensions):

• Attackers gained access to Checkmarx's GitHub repository and Docker Hub registry, overwriting existing KICS image tags with trojanized builds and introducing a new v2.1.21 tag with no corresponding upstream release.

  • The bundled KICS binary was replaced with a modified Golang executable that retains scanner functionality while adding credential collection and exfiltration capabilities.

• In parallel, a backdated orphaned commit was injected into the Checkmarx/ast-vscode-extension repository, introducing a large (~10 MB) obfuscated JavaScript file (mcpAddon.js).

  • Compromised VS Code extension versions activate a hidden feature on load that fetches and executes mcpAddon.js using the Bun JavaScript runtime, writing the payload to ~/.checkmarx/mcp/mcpAddon.js.

Attack Chain (Bitwarden CLI):

• A Bitwarden engineer's GitHub account was compromised. The attacker created a malicious branch in the bitwarden/clients repository, uploaded a prebuilt trojanized tarball, and altered the publish-cli.yml workflow to exchange a GitHub Actions OIDC token for an npm authentication token.

• This allowed the attacker to publish the malicious package as @bitwarden/[email protected]. The attacker then deleted all related workflow runs, the branch, and the release tag.

• The compromised package includes a preinstall hook (bw_setup.js) that downloads the Bun JavaScript runtime and silently executes the primary credential stealer (bw1.js, 9.7 MB).

  • Bun is used in place of Node.js as a deliberate evasion technique, bypassing EDR and SIEM detections tuned to flag suspicious node child processes during package installation.

  • The underlying Bitwarden CLI functionality is preserved so victims receive a working bw command with no visible errors.

• This incident marks the first confirmed supply chain attack exploiting npm's OIDC Trusted Publishing mechanism as a publishing channel.

Post-Exploitation Behavior (Common to Both Sub-Campaigns):

• Credential Harvesting: Both payloads collect GitHub and npm tokens, SSH keys, AWS and GCP credentials, Azure authentication tokens, shell history, environment variables, .env files, and AI coding tool configurations, including Claude Code (~/.claude.json), Kiro MCP settings, Cursor, Codex CLI, and Aider.

  • Any API keys stored in AI assistant contexts on affected systems should be considered compromised.

• Exfiltration: Collected data is encrypted with AES-256-GCM and transmitted to https://audit.checkmarx[.]cx/v1/telemetry (94[.]154[.]172[.]43), an attacker-controlled domain designed to impersonate Checkmarx's legitimate infrastructure.

  • If the primary C2 is blocked, the malware falls back to creating encrypted staging repositories under the victim's own GitHub account, using a recognizable Dune universe naming pattern (<word>-<word>-<3 digits>), and supports signed domain rotation via an embedded RSA public key.

• GitHub Actions Workflow Injection: Using stolen GitHub tokens, the malware injects a malicious workflow (.github/workflows/format-check.yml) into accessible repositories, serializing all configured secrets into a downloadable artifact (format-results.txt), then deletes the branch and run to reduce forensic visibility.

• npm Propagation: Stolen npm tokens are used to identify publishable packages and republish them with injected preinstall hooks, allowing for lateral spread across the npm ecosystem.

• Persistence (Bitwarden variant): bw1.js injects itself into ~/.bashrc and ~/.zshrc. A lock file (/tmp/tmp.987654321.lock) prevents multiple simultaneous instances.

  • The payload also exits silently if the system locale begins with ru.