TeamPCP Compromises KICS GitHub Action and Checkmarx OpenVSX Extensions to Steal Credentials

Mar 23, 2026 · Original article ↗

Summary

Wiz reports TeamPCP compromised KICS GitHub Action tags and two Checkmarx OpenVSX extensions, deploying credential-stealing malware with GitHub, cloud and Kubernetes access capabilities. PyPI packages were also affected; maintainers and PyPI took action.

Key points

The KICS GitHub Action was compromised from 12:58 to 16:50 UTC on March 23; the attacker redirected 35 tags to staged commits that ran a malicious setup.sh.
The malware collected environment variables, SSH keys, GitHub runner memory, cloud credentials and Kubernetes tokens, then encrypted and exfiltrated the data to checkmarx[.]zone.
If direct exfiltration failed, the malware could create a docs-tpcp repository in a victim’s GitHub account and upload the stolen data.
With sufficient Kubernetes permissions, the payload attempted to deploy privileged pods and install persistence; on Linux hosts it used a hidden directory and a systemd user service.
Checkmarx OpenVSX extensions ast-results 2.53.0 and cx-dev-assist 1.7.0 were compromised. The article says corresponding VS Code Marketplace versions appeared unaffected.
The article also reports trojanized litellm PyPI versions 1.82.7 and 1.82.8, quarantined by PyPI, and a reported impact to ast-github-action.
Security teams should review affected workflow references and logs from the exposure window, search for docs-tpcp repositories, and follow Checkmarx’s security update.

Article Details

Attack Vectors: Compromised KICS GitHub Action tags were redirected to staged commits that ran setup.sh through a modified action.yaml.
The attacker used an apparently compromised cx-plugins-releases service account to publish malicious tags.
Compromised Open VSX extensions ast-results 2.53.0 and cx-dev-assist 1.7.0 invoked a credential-stealing payload when activated.
The payload searched environment variables, SSH keys, files, GitHub Actions runner memory, cloud metadata endpoints, and Kubernetes API resources for secrets.
Stolen data was encrypted and sent to attacker-controlled infrastructure; when that failed, the script could create a repository and release in a victim's GitHub account to upload the data.
On sufficiently privileged Kubernetes environments, the script attempted to deploy a privileged pod across cluster nodes and install a persistent backdoor. On Linux hosts and non-CI systems, it used hidden directories and a systemd user service for persistence.
The article also reports trojanized litellm packages, versions 1.82.7 and 1.82.8, published on PyPI.
Defensive Notes: Review workflows that use kics-github-action; for references pinned to version tags rather than commit SHAs, inspect workflow logs from the exposure window for signs of compromise.
Search GitHub organizations for repositories named docs-tpcp as a possible sign of successful fallback exfiltration.
Review exposure to the compromised Open VSX extension versions and the trojanized litellm package versions identified in the article.
Use the security update and ongoing guidance referenced by Checkmarx and Wiz to assess exposure and remediation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]zone`	Attacker-controlled domain used for exfiltration and payload retrieval.
DOMAIN	`models[.]litellm[.]cloud`	Reported exfiltration domain used by the trojanized litellm packages.
IPV4	`83[.]142[.]209[.]11`	IP address identified as the exfiltration server for the compromised GitHub Action.
SHA256	`0d66d8c7e02574ff0d3443de0585af19c903d12466d88573ed82ec788655975c`	SHA-256 hash of the malicious checkmarx-util-1.0.4.tgz payload.
SHA256	`527f795a201a6bc114394c4cfd1c74dce97381989f51a4661aafbc93a4439e90`	SHA-256 hash of the malicious environmentAuthChecker.js file.
SHA256	`65bd72fcddaf938cefdf55b3323ad29f649a65d4ddd6aea09afa974dfc7f105d`	SHA-256 hash of the compromised ast-results-2.53.0.vsix artifact.
SHA256	`744c9d61b66bcd2bb5474d9afeee6c00bb7e0cd32535781da188b80eb59383e0`	SHA-256 hash of the compromised cx-dev-assist-1.7.0.vsix artifact.
URL	`hxxps[:]//checkmarx[.]zone`	Attacker-controlled endpoint used to receive the encrypted stolen-data bundle.
URL	`hxxps[:]//checkmarx[.]zone/raw`	Attacker-controlled endpoint polled for follow-on payload links.