Checkmarx KICS Official Docker Repo Compromised to Inject Malicious Code

A supply-chain attack tampered with Checkmarx KICS Docker images and weaponized VS Code/Open VSX extensions to deploy trojanized binaries and a ~10MB obfuscated JavaScript payload that steals GitHub, cloud, npm, SSH, and environment secrets, exfiltrating them to an attacker-controlled endpoint and enabling injection of malicious GitHub Actions and npm republishing for further propagation. Socket published technical analysis, IOCs (including C2, IP, and SHA256 hashes), and immediate remediation steps such as removing affected artifacts, rotating credentials, auditing repos, and pinning images to SHA256 digests.