Security researchers have uncovered a significant supply chain attack targeting Checkmarx's KICS (Keeping Infrastructure as Code Secure) — a widely used open-source tool for scanning infrastructure-as-code (IaC) files — after attackers pushed malicious images directly into its official Docker Hub repository and potentially compromised related VS Code extensions.
The discovery began when Docker's internal monitoring flagged suspicious activity on the checkmarx/kics repository and alerted Socket's research team. What investigators found was alarming: attackers hadn't just slipped in a rogue image — they overwrote legitimate, trusted tags including v2.1.20, alpine, debian, and latest, while also publishing a fake v2.1.21 tag that has no corresponding upstream release.
The tampered KICS binary embedded inside those images carried capabilities that the real tool never had. According to Socket's analysis, the malware could generate a full, uncensored scan report, encrypt it, and silently ship it to an attacker-controlled external endpoint.
For security teams using KICS to audit Terraform, CloudFormation, or Kubernetes configurations — files that routinely contain API keys, database credentials, and cloud access secrets — the exposure could be severe.
The attack didn't stop at Docker Hub. Socket researchers also flagged suspicious behavior in recent Checkmarx VS Code extension releases. Versions 1.17.0 and 1.19.0 were found to contain code that downloaded and executed a remote JavaScript add-on via the Bun runtime (a fast JavaScript execution environment), pulling from a hardcoded GitHub URL without any integrity check or user prompt. The malicious behavior was absent in version 1.18.0, suggesting it was deliberately inserted and then briefly pulled back.
Socket credited Docker for catching the suspicious push early, allowing rapid containment. Checkmarx has since restored the affected tags to their legitimate versions and deleted the fraudulent v2.1.21 tag.
What you should do now:
- If you pulled any of the affected tags (v2.1.20, v2.1.20-debian, alpine, debian, latest) before remediation, treat any secrets those scans touched as compromised and rotate them immediately.
- Audit your VS Code extension version — if you ran 1.17.0 or 1.19.0, review your environment for suspicious outbound connections.
- Pin image digests rather than relying on mutable tags to prevent silent tag overwrites in future CI/CD pipelines.
Socket has disclosed findings to Checkmarx and says a full technical analysis is forthcoming as the investigation continues.