Malicious Artifacts Found in Official KICS Docker Repository and Code Extensions
Essential information
- Published
- 23/04/2026 00:57
- Modified
- 27/04/2026 14:33
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- canister worm checkmarx kics ci/cd compromise credential theft docker hub poisoning github actions mcpaddon.js npm propagation supply chain compromise vs code extension
- Tags
- 2026-04-22 canister worm checkmarx kics ci/cd compromise credential-theft docker hub poisoning github actions mcpaddon.js npm propagation supply chain compromise vs code extension
- Related entities
- 14 indicators, 14 observables, 1 intrusion sets (apt), 19 techniques (mitre), 2 malware, 2 others
Description
Docker and Socket uncovered a supply chain compromise affecting Checkmarx KICS distribution channels. Attackers poisoned official Docker Hub images (tags v2.1.20, v2.1.21, alpine) and VS Code extensions (versions 1.17.0, 1.19.0), introducing unauthorized data exfiltration capabilities. The trojanized KICS binary collects and encrypts scan reports containing credentials from infrastructure-as-code files, transmitting them to external endpoints. Compromised VS Code extensions download mcpAddon.js via Bun runtime, harvesting GitHub tokens, AWS credentials, Azure tokens, npm configurations, and SSH keys. The malware creates public GitHub repositories for staging stolen data, injects malicious GitHub Actions workflows to capture repository secrets, and uses stolen npm credentials to identify writable packages for propagation. TeamPCP appears to claim responsibility for this multi-stage attack designed to steal developer credentials and propagate through CI/CD pipelines.