DEVOURED
Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions
Attackers compromised official Checkmarx KICS Docker images and VS Code extensions, injecting trojanized binaries to exfiltrate cloud, GitHub, and developer credentials.
What: Checkmarx's KICS (Keep Infrastructure as Code Secure) Docker images and VS Code extensions were compromised. Attackers replaced legitimate tags with malicious versions, including trojanized binaries and mcpAddon.js, to steal cloud, GitHub, and developer credentials via GitHub repositories, Actions workflows, and npm republishing, indicating a multi-stage supply chain attack.
Why it matters: This incident highlights the increasing sophistication and multi-pronged nature of supply chain attacks targeting developer tools and infrastructure-as-code assets, emphasizing the need for rigorous vetting of software components and continuous monitoring of official distribution channels.
Takeaway: If you use Checkmarx KICS Docker images or VS Code extensions, immediately verify their integrity and check for any unauthorized credential exfiltration attempts. Review your CI/CD pipelines and GitHub Actions for suspicious activity.
Decoder
- Checkmarx KICS (Keep Infrastructure as Code Secure): An open-source static analysis tool for security vulnerabilities in Infrastructure as Code (IaC) files.
- Trojanized binaries: Legitimate software files that have been secretly modified to contain malicious code, appearing harmless but designed to perform unauthorized actions.
- Supply chain attack: A cyberattack that targets less secure elements in a supply network, like software dependencies or update mechanisms, to ultimately compromise the main target.
Original article
Full article content is not available for inline reading.
Explore all 53 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi