Checkmarx Supply Chain Hit by Malicious Docker Images

Attackers dropped malicious KICS Docker images and rogue VS Code extensions into the Checkmarx supply chain, putting developers who rely on these tools directly in the crosshairs. The Checkmarx supply chain attack is a sharp reminder that the tools you use to find vulnerabilities can themselves become the attack surface. If you pull a compromised scanner image into your CI/CD pipeline, you have handed an attacker a seat inside your build process.

How the Malicious KICS Docker Images Were Distributed

KICS (Keeping Infrastructure as Code Secure) is widely used by engineering teams to scan Terraform, Kubernetes, and Dockerfile configurations for security misconfigurations. Attackers exploited that trust by publishing poisoned Docker images that mimicked legitimate KICS releases. Developers pulling these images via automated pipelines or manual docker pull commands received a backdoored version of the tool without any obvious warning.

The VS Code extension angle compounds the problem. Malicious extensions in the marketplace can execute arbitrary code the moment a developer opens a workspace. Combined with a tampered KICS image, an attacker gets two separate footholds: one inside the editor environment and one inside the container build process. Either channel alone is serious. Both together give an attacker broad access to source code, environment variables, cloud credentials, and pipeline secrets.

Why This Attack Pattern Is Effective Against Developer Tooling

Security tooling occupies a privileged position. Scanners need read access to source code. Extensions run with the permissions of the IDE process. Pipeline runners often have elevated cloud IAM roles. Attackers know this. Targeting a tool like KICS means compromising something developers actively trust and rarely scrutinize.

The package name confusion tactic used here follows a pattern seen in npm and PyPI attacks: publish something that looks official, wait for automated systems or habit to pull it, collect credentials. The difference with Docker Hub and VS Code Marketplace is that verification controls have historically been weaker than in some language package registries.

Impact on Development and CI/CD Pipelines

Any team running KICS scans as part of their pipeline that pulled affected images should assume secrets exposure is possible. This includes AWS keys, GitHub tokens, Kubernetes service account credentials, and anything else present as environment variables or mounted secrets during the build. Source code repositories connected to affected workstations running the malicious extension are also at risk.

Downstream impact extends to customers if a compromised build artifact gets shipped. Supply chain attacks do not stay contained to the initial victim.

How to Protect Your Pipeline from Supply Chain Attacks

Start by pinning Docker images to verified digests rather than mutable tags like latest. A tag can be silently replaced. A digest cannot. Verify image signatures using Docker Content Trust or a tool like Cosign before pulling anything into a build environment.

For VS Code extensions, audit what is installed across your team. Cross-reference installed extension IDs against the official publisher accounts. Remove anything that cannot be verified. Enable extension signature verification where your tooling supports it.

Review your CI/CD pipeline logs for unexpected outbound network connections originating from scanner steps. Malicious images frequently beacon back to attacker-controlled infrastructure. Short-lived egress anomalies during build steps are a signal worth investigating.

Run a full DAST scan on your web applications to check whether any secrets exfiltrated during build processes have already been used to probe your running services.

Use a software bill of materials (SBOM) for every build. If you cannot enumerate what ran during your pipeline, you cannot audit it after an incident.

What versions of KICS were affected by this supply chain attack? Specific version ranges are still being confirmed by Checkmarx. Treat any KICS Docker image pulled by tag rather than verified digest over the past several months as suspect until official confirmation is published.

How do I check if a malicious VS Code extension ran in my environment? Check your VS Code extension list with code --list-extensions and compare against known-good snapshots. Review process logs and outbound network activity from your development machine around the time extensions were installed or updated.

Should I rotate all secrets if my pipeline used an unverified KICS image? Yes. Assume any secret accessible during affected pipeline runs is compromised. Rotate immediately and audit access logs for those credentials.

Scan your web applications for vulnerabilities that may stem from exposed pipeline secrets at VibeWShield.