Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

Security researchers reported that unknown actors compromised Checkmarx distribution channels by pushing poisoned Docker images to the official checkmarx/kics repository (modified KICS binary capable of collecting, encrypting, and exfiltrating scan reports) and by publishing VS Code extension releases that downloaded and executed remote code via the Bun runtime; organizations using affected images or extensions should treat any scanned secrets as potentially compromised.