{"id":683,"date":"2026-04-22T19:00:56","date_gmt":"2026-04-22T19:00:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=683"},"modified":"2026-04-22T19:00:56","modified_gmt":"2026-04-22T19:00:56","slug":"malicious-kics-docker-images-and-vs-code-extensions-hit-checkmarx-supply-chain","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=683","title":{"rendered":"Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 22, 2026<\/span><\/span>Cloud Security \/ Software Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have warned of malicious images pushed to the official \u00abcheckmarx\/kics<\/a>\u00bb Docker Hub repository.<\/p>\n

In an alert published today, software supply chain security company Socket revealed<\/a> that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and alpine, while also introducing a new v2.1.21 tag that does not correspond to an official release. The Docker repository has been archived as of writing.<\/p>\n

\u00abAnalysis of the poisoned image indicates that the bundled KICS binary was modified to include data collection and exfiltration capabilities not present in the legitimate version,\u00bb Socket said.<\/p>\n

\u00abThe malware could generate an uncensored scan report, encrypt it, and send it to an external endpoint, creating a serious risk for teams using KICS to scan infrastructure-as-code files that may contain credentials or other sensitive configuration data.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Further analysis of the incident has uncovered that related Checkmarx developer tooling may also have been affected, such as recent Microsoft Visual Studio Code extension releases that come with malicious code to download and run a remote addon through the Bun runtime.<\/p>\n

\u00abThe behavior appeared in versions 1.17.0 and 1.19.0, was removed in 1.18.0, and relied on a hardcoded GitHub URL to fetch and run additional JavaScript without user confirmation or integrity verification,\u00bb Socket added.<\/p>\n

Organizations that may have used the affected KICS image to scan Terraform, CloudFormation, or Kubernetes configurations should treat any secrets or credentials exposed to those scans as likely compromised.<\/p>\n

\u00abThe evidence suggests this is not an isolated Docker Hub incident, but part of a broader supply chain compromise affecting multiple Checkmarx distribution channels,\u00bb the company noted.<\/p>\n

The Hacker News has contacted Checkmarx for further information, and we will update the story if we hear back.<\/p>\n

(This is a developing story. Please check back for more details.)<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Apr 22, 2026Cloud Security \/ Software Security Cybersecurity researchers have warned of malicious images pushed to the official \u00abcheckmarx\/kics\u00bb Docker Hub repository. In an alert published today, software supply…<\/p>\n","protected":false},"author":1,"featured_media":684,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[219,857,10,136,361,434,1052,1363,33,218],"class_list":["post-683","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-chain","tag-checkmarx","tag-code","tag-docker","tag-extensions","tag-hit","tag-images","tag-kics","tag-malicious","tag-supply"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=683"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/683\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/684"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}