Socket Reports Malicious KICS Images and VS Code Extensions in Checkmarx Supply-Chain Incident

Summary

Socket reports that attackers altered Checkmarx KICS Docker image tags and that some VS Code extensions ran malicious code. The KICS binary could exfiltrate scan reports; the Docker repository was archived.

Key points

Socket said unknown actors overwrote the KICS Docker image tags v2.1.20 and alpine and added a non-official v2.1.21 tag.
Socket's analysis found the poisoned KICS binary could generate, encrypt, and exfiltrate uncensored scan reports.
Visual Studio Code extension versions 1.17.0 and 1.19.0 reportedly used Bun to download and run a remote add-on; version 1.18.0 did not exhibit this behavior.
The extension code reportedly fetched additional JavaScript from a hardcoded GitHub URL without user confirmation or integrity verification.
Organizations that scanned Terraform, CloudFormation, or Kubernetes configurations with affected images were advised to treat exposed secrets or credentials as likely compromised.
Socket assessed the incident as a broader compromise across Checkmarx distribution channels; the Docker repository had been archived.

Article Details

Event Type: Software supply-chain compromise involving malicious KICS Docker images and affected Checkmarx Visual Studio Code extension releases.
Impact: The poisoned KICS binary could generate, encrypt, and exfiltrate uncensored scan reports, potentially exposing credentials and sensitive configuration data. Affected extension releases downloaded and executed a remote JavaScript add-on without user confirmation or integrity verification. The Docker repository was archived; Socket described the incident as part of a broader compromise affecting multiple Checkmarx distribution channels.