KICS GitHub Action Compromised: TeamPCP Supply Chain Attack

The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the identical group behind the Trivy attack. KICS is an open supply infrastructure as code safety scanner by Checkmarx. Between 12:58 and 16:50 UTC on March twenty third, any customers of this GitHub Action who have been pinning to one of many compromised tags would have been served the malware. The repository was taken down at 16:50 UTC, shortly after a GitHub issue was filed by a user notifying the maintainers of the incident.

The motion was accessible at https://github.com/Checkmarx/kics-github-action previous to takedown.

Update 03/24:

11:30 UTC: The “litellm” packages (variations 1.82.7 and 1.82.8) on PyPI have been trojanized. They comprise with the identical performance because the earlier operation, however utilizing a brand new exfiltration area: fashions.litellm[.]cloud. The malicious replace was revealed at roughly 8:30 UTC and was been quarantined by PyPI at 11:25 UTC. Wiz clients can see an advisory within the Threat Center.

Updates 03/23:
19:24 UTC: The repository has been reinstated, and the maintainers state “The issue is resolved now.”

22:25 UTC: Sysdig experiences that ast-github-action was additionally impacted. They have been restricted to observing a single malicious tag 2.3.28 – nonetheless based mostly on TeamPCPs ways, we consider it’s probably all tags have been impacted.

22:35 UTC: Based on a tip from impartial researcher Adnan Khan, Wiz has confirmed that Checkmarx OpenVSX extensions cx-dev-assist 1.7.0 and ast-results 2.53.0 have been compromised. This was concurrently reported by ReversingLabs via tweet. See “OpenVSX Payload” part under for particulars. We have reported these to OpenVSX for removing.

Update 03/24 9:00 UTC: Checkmarx have revealed a Security Update addressing the problems with the KICS GitHub motion and OpenVSX plugins. They state a decision time of 15:41 UTC for OpenVSX, nonetheless we noticed the malicious variations have been current on the time of our report. Additionally, whereas new variations have been pushed, the malicious variations have but to be eliminated.

This is the second standard open supply safety scanner that this group has compromised within the final 5 days. The operation makes use of acquainted naming conventions and the identical RSA public key, permitting Wiz to evaluate with excessive confidence that it’s the identical actor. 

KICS Github Action Payload

The malicious code was injected in the identical method because the Trivy incident:

1. The attacker staged imposter commits (commits on a fork of the repository) containing their payload: setup.sh

2. The attacker then used what seems to be a compromised id to immediately replace all 35 tags within the challenge and level them to these staged commits

The malware additionally capabilities equally, however with just a few key variations:

• This model makes use of a brand new C2 area: checkmarx.zone. 

• The new model creates a docs-tpcp repository by way of the sufferer’s GITHUB_TOKENs as a fallback to C2 disruption. In the Trivy incident, tpcp-docs was used as an alternative.

• This model provides Kubernetes targeted persistence code, along with the present credential stealing and exfiltration code. 

While kics-github-action has ~1% of the seen public utilization of trivy-action, it’s nonetheless broadly adopted publicly and privately as an Infrastructure as Code safety scanner.

We will replace this publish with additional evaluation.

Github Compromise

The assault seems to have been completed by way of the compromise of the cx-plugins-releases (GitHub ID 225848595) service account, as that’s the id concerned in publishing the malicious tags. 

OpenVSX Payload

Both compromised extensions (ast-results v2.53.0 and cx-dev-assist v1.7.0) contained similar payloads. They have been revealed 12 seconds aside at 12:53 UTC on March 23, 2026, by way of the ast-phoenix account on Open VSX. The VS Code Marketplace variations seem unaffected.

Payload Execution Flow

1. On activation of the extension, the brand new malicious environmentAuthChecker.js is invoked from activateCore.js

2. This payload first checks if the sufferer has credentials for not less than one cloud supplier

If any credentials are detected, the second-stage payload is retrieved from the C2: checkmarx[.]zone/static/checkmarx-util-1.0.4.tgz

1. The payload makes an attempt execution by way of npx, bunx, pnpx, or yarn dlx. This covers main JavaScript package deal managers. The retrieved package deal contrains a complete credential stealer.

2. Harvested credentials are then encrpyted, utilizing the keys as elsewhere on this marketing campaign, and exfiltrated to checkmarx[.]zone/vsx as tpcp.tar.gz.

On non-CI techniques, the malware installs persistence by way of a systemd consumer service. The persistence script polls https://checkmarx[.]zone/raw each 50 minutes for extra payloads, with a kill swap that aborts if the response accommodates “youtube”. Currently, the hyperlink redirects to The Show Must Go On by Queen.

Compromised Artifacts

OpenVSX Extensions

kics-github-action Releases

The v1.1 release was the one malicious launch created. Other releases, triggered routinely by the tag occasions, failed as a result of these variations already existed.

kics-github-action Tags

Which actions ought to safety groups take?

1. Audit KICS GitHub Actions references: Review workflows utilizing kics-github-action. If you referenced a model tag reasonably than a SHA, verify workflow run logs from the publicity window for indicators of compromise.

2. Search for exfiltration artifacts: Look for repositories named docs-tpcp in your GitHub group, which can point out profitable exfiltration by way of the fallback mechanism.

Long-term hardening: Refer to Wiz’s How to Harden GitHub Actions: The Unofficial Guide

How can Wiz assist?

Wiz clients ought to proceed to watch the advisory within the Wiz Threat Center for ongoing steerage, pre-built queries, and references to related detections they will use to evaluate the danger  of their surroundings.

Worried you’ve been impacted? Connect with the Wiz Incident Response team.