{
  "entry": {
    "kind": "vuln",
    "slug": "checkmarx-supply-chain-compromise-malicious-vs-code-extensions-and",
    "name": "checkmarx-supply-chain-compromise-malicious-vs-code-extensions-and",
    "vendor": "Checkmarx KICS Docker images",
    "description": "The ongoing Checkmarx supply chain campaign expanded in April 2026 with attackers publishing malicious KICS Docker images and VS Code extensions through compromised CI/CD pipelines. Stolen GitHub and npm tokens were used to inject credential-stealing malware into downstream packages. Data encrypted with AES-256-GCM is exfiltrated to audit.checkmarx[.]cx, a domain impersonating Checkmarx. The campaign also compromised Bitwarden CLI 2026.4.0 via the same attack chain.",
    "website": "https://socket.dev/blog/bitwarden-cli-compromised",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "ide-extension",
    "updatedAt": "2026-04-22",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "checkmarx-supply-chain-compromise-malicious-vs-code-extensions-and",
      "aliases": [
        "ti-014"
      ],
      "title": "Checkmarx Supply Chain Compromise: Malicious VS Code Extensions and Docker Images",
      "summary": "The ongoing Checkmarx supply chain campaign expanded in April 2026 with attackers publishing malicious KICS Docker images and VS Code extensions through compromised CI/CD pipelines. Stolen GitHub and npm tokens were used to inject credential-stealing malware into downstream packages. Data encrypted with AES-256-GCM is exfiltrated to audit.checkmarx[.]cx, a domain impersonating Checkmarx. The campaign also compromised Bitwarden CLI 2026.4.0 via the same attack chain.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "ide-extension",
      "component": {
        "name": "Checkmarx KICS Docker images",
        "vendor": null,
        "package": null,
        "ecosystem": "vscode",
        "catalogSlug": "agent/vscode"
      },
      "affected": [
        {
          "range": "Checkmarx KICS Docker images, ast-github-action, kics-github-action, @bitwarden/cli@2026.4.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-22",
      "modifiedAt": "2026-04-22",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://socket.dev/blog/bitwarden-cli-compromised"
        }
      ],
      "mitigation": "Remove @bitwarden/cli@2026.4.0 if installed. Rotate all exposed credentials (GitHub tokens, npm tokens, CI/CD secrets). Audit for outbound connections to audit.checkmarx.cx. Hunt for lock file /tmp/tmp.987654321.lock. Pin dependencies and verify checksums.",
      "detectedByAnomity": true
    }
  }
}