Checkmarx KICS Docker images and VS Code extensions compromised in supply-chain attack
Researchers discovered that attackers overwrote tags in the official checkmarx/kics Docker Hub repository and injected malicious code into recent VS Code extensions, adding binaries that exfiltrate cloud, GitHub and developer credentials. The compromised images can leak scanned IaC secrets, posing a broad supply‑chain risk for teams using KICS.