TeamPCP Hijacks Checkmarx in Sprawling Supply Chain Strike

Researchers discovered a supply-chain attack in which official Checkmarx Docker images and VS Code extensions were hijacked to deploy a credential-stealing malware (mcpAddon.js) that exfiltrates secrets by creating deceptive GitHub repositories and injecting malicious GitHub Actions workflows; the campaign, attributed to 'TeamPCP', also attempts npm package takeovers to propagate and compromises developer and cloud credentials.