KICS GitHub Action Compromised: TeamPCP Supply Chain Attack

The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the identical group behind the Trivy attack. KICS is an open supply infrastructure as code safety scanner by Checkmarx. Between 12:58 and 16:50 UTC on March twenty thirdany customers of this GitHub Action who have been pinning to one of many compromised tags would have been served the malware. The repository was taken down at 16:50 UTC, shortly after a GitHub issue was filed by a user notifying the maintainers of the incident.

The motion was out there at https://github.com/Checkmarx/kics-github-action previous to takedown.

Update 03/24:

11:30 UTC: The “litellm” packages (variations 1.82.7 and 1.82.8) on PyPI have been trojanized. They comprise with the identical performance because the earlier operation, however utilizing a brand new exfiltration area: fashions.litellm[.]cloud. The malicious replace was revealed at roughly 8:30 UTC and was quarantined by PyPI at 11:25 UTC. Wiz clients can see an advisory within the Threat Center.

Updates 03/23:
19:24 UTC: The repository has been reinstated, and the maintainers state “The issue is resolved now“

22:25 UTC: Sysdig stories that ast-github-action was additionally impacted. They have been restricted to observing a single malicious tag 2.3.28 – However primarily based on TeamPCPs techniques, we imagine it’s seemingly all tags have been impacted.

22:35 UTC: Based on a tip from impartial researcher Adnan Khan, Wiz has confirmed that Checkmarx OpenVSX extensions cx-dev-assist 1.7.0 and ast-results 2.53.0 have been compromised. This was concurrently reported by ReversingLabs via tweet. See “OpenVSX Payload” part under for particulars. We have reported these to OpenVSX for removing.

Update 03/24 9:00 UTC: Checkmarx have revealed to Security Update addressing the problems with the KICS GitHub motion and OpenVSX plugins. They state a decision time of 15:41 UTC for OpenVSXnevertheless we noticed the malicious variations have been current on the time of our report. Additionally, whereas new variations have been pushed, the malicious variations have but to be eliminated.

This is the second common open supply safety scanner that this group has dedicated to within the final 5 days. The operation makes use of acquainted naming conventions and the identical RSA public key, permitting Wiz to evaluate with excessive confidence that it’s the identical actor.

KICS Github Action Payload

The malicious code was injected in the identical method because the Trivy incident:

1. The attacker staged imposter commits (commits on a fork of the repository) containing their payload: setup.sh

2. The attacker then used what seems to be a compromised identification to instantly replace all 35 tags within the undertaking and level them to these staged commits

The malware additionally capabilities equally, however with just a few key variations:

• This model makes use of a brand new C2 area: checkmarx.zone.

• The new model creates a docs-tpcp repository through the sufferer’s GITHUB_TOKENs as a fallback to C2 disruption. In the Trivy incident, tpcp-docs was used as an alternative.

• This model provides Kubernetes centered persistence code, along with the prevailing credential stealing and exfiltration code.

While kics-github-action has ~1% of the seen public utilization of trivy-actionit’s nonetheless broadly adopted publicly and privately as an Infrastructure as Code safety scanner.

We will replace this submit with additional evaluation.

Github Commit

The assault seems to have been completed through the compromise of the cx-plugins-releases (GitHub ID 225848595) service account, as that’s the identification concerned in publishing the malicious tags.

OpenVSX Payload

Both dedicated extensions (ast-results v2.53.0 and cx-dev-assist v1.7.0) contained equivalent payloads. They have been revealed 12 seconds aside at 12:53 UTC on March 23, 2026, through the ast-phoenix account on Open VSX. The VS Code Marketplace variations seem unaffected.

Payload Execution Flow

1. On activation of the extension, the brand new malicious environmentAuthChecker.js is invoked from activateCore.js

2. This payload first checks if the sufferer has credentials for a minimum of one cloud supplier

If any credentials are detected, the second-stage payload is retrieved from the C2: checkmarx[.]zone/static/checkmarx-util-1.0.4.tgz

1. The payload makes an attempt execution through npx, bunx, pnpx, or yarn dlx. This covers main JavaScript package deal managers. The retrieved package deal contrains a complete credential stealer.

2. Harvested credentials are then encrpyted, utilizing the keys as elsewhere on this marketing campaign, and exfiltrated to checkmarx[.]zone/vsx ace tpcp.tar.gz.

On non-CI programs, the malware installs persistence through a systemd person service. The persistence script polls https://checkmarx[.]zone/raw each 50 minutes for extra payloads, with a kill swap that aborts if the response incorporates “youtube”. Currently, the hyperlink redirects to The Show Must Go On by Queen.

Compromised Artifacts

OpenVSX Extensions

kics-github-action Releases

The v1.1 release was the one malicious launch created. Other releases, triggered routinely by the tag occasions, failed as a result of these variations already existed.

kics-github-action Tags

What actions ought to safety groups take?

1. Audit KICS GitHub Actions references: Review workflows utilizing kics-github-action. If you referenced a model tag fairly than a SHA, test workflow run logs from the publicity window for indicators of compromise.

2. Search for exfiltration artifacts: Look for repositories named docs-tpcp in your GitHub group, which can point out profitable exfiltration through the fallback mechanism.

Long-term hardening: Refer to Wiz’s How to Harden GitHub Actions: The Unofficial Guide

How can Wiz assist?

Wiz clients ought to proceed to observe the advisory within the Wiz Threat Center for ongoing steerage, pre-built queries, and references to related detections they’ll use to evaluate the danger of their atmosphere.

Worried you have been impacted? Connect with the Wiz Incident Response team.