Checkmarx Alert: Malicious Plugins and GitHub Actions Hit OpenVSX in New Supply Chain Attack

Checkmarx reported a supply-chain incident on March 23, 2026 where attackers published compromised versions of two Checkmarx plugins (ast-results-2.53.0.vsix and cx-dev-assist-1.7.0.vsix) to the OpenVSX registry between 02:53–15:41 UTC, and briefly compromised the KICS GitHub Action distribution between 12:58–16:50 UTC; Checkmarx states the VS Code Marketplace and KICS itself were not affected, clean plugin versions have been released, and recommended mitigations include rotating secrets, auditing GitHub Actions logs for indicators (e.g., tpcp.tar.gz, aquasecurity, checkmarx.zone), and checking for shadow repositories.