KICS GitHub Action Compromised: TeamPCP Supply Chain Attack

The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the same group behind the Trivy attack. KICS is an open source infrastructure as code security scanner by Checkmarx. Between 12:58 and 16:50 UTC on March 23rd, any users of this GitHub Action who were pinning to one of the compromised tags would have been served the malware. The repository was taken down at 16:50 UTC, shortly after a GitHub issue was filed by a user notifying the maintainers of the incident.

The action was available at prior to takedown.

Update 03/24:

11:30 UTC: The “litellm” packages (versions 1.82.7 and 1.82.8) on PyPI have been trojanized. They contain with the same functionality as the previous operation, but using a new exfiltration domain: models.litellm[.]cloud. The malicious update was published at approximately 8:30 UTC and was been quarantined by PyPI at 11:25 UTC. Wiz customers can see an advisory in the Threat Center.

Updates 03/23:
19:24 UTC: The repository has been reinstated, and the maintainers state “The issue is resolved now.”

22:25 UTC: Sysdig reports that ast-github-action was also impacted. They were limited to observing a single malicious tag 2.3.28 – however based on TeamPCPs tactics, we believe it is likely all tags were impacted.

22:35 UTC: Based on a tip from independent researcher Adnan Khan, Wiz has confirmed that Checkmarx OpenVSX extensions cx-dev-assist 1.7.0 and ast-results 2.53.0 have been compromised. This was concurrently reported by ReversingLabs via tweet. See “OpenVSX Payload” section below for details. We have reported these to OpenVSX for removal.

Update 03/24 9:00 UTC: Checkmarx have published a Security Update addressing the issues with the KICS GitHub action and OpenVSX plugins. They state a resolution time of 15:41 UTC for OpenVSX, however we observed the malicious versions were present at the time of our report. Additionally, while new versions have been pushed, the malicious versions have yet to be removed.

This is the second popular open source security scanner that this group has compromised in the last five days. The operation uses familiar naming conventions and the same RSA public key, allowing Wiz to assess with high confidence that it is the same actor. 

KICS Github Action Payload

The malicious code was injected in the same manner as the Trivy incident:

1. The attacker staged imposter commits (commits on a fork of the repository) containing their payload: setup.sh

2. The attacker then used what appears to be a compromised identity to directly update all 35 tags in the project and point them to those staged commits

The malware also functions similarly, but with a few key differences:

• This version uses a new C2 domain: checkmarx.zone. 

• The new version creates a docs-tpcp repository via the victim’s GITHUB_TOKENs as a fallback to C2 disruption. In the Trivy incident, tpcp-docs was used instead.

• This version adds Kubernetes focused persistence code, in addition to the existing credential stealing and exfiltration code. 

While kics-github-action has ~1% of the visible public usage of trivy-action, it is still broadly adopted publicly and privately as an Infrastructure as Code security scanner.

We will update this post with further analysis.

Github Compromise

The attack appears to have been accomplished via the compromise of the cx-plugins-releases (GitHub ID 225848595) service account, as that is the identity involved in publishing the malicious tags. 

OpenVSX Payload

Both compromised extensions (ast-results v2.53.0 and cx-dev-assist v1.7.0) contained identical payloads. They were published 12 seconds apart at 12:53 UTC on March 23, 2026, via the ast-phoenix account on Open VSX. The VS Code Marketplace versions appear unaffected.

Payload Execution Flow

1. On activation of the extension, the new malicious environmentAuthChecker.js is invoked from activateCore.js

2. This payload first checks if the victim has credentials for at least one cloud provider

If any credentials are detected, the second-stage payload is retrieved from the C2: checkmarx[.]zone/static/checkmarx-util-1.0.4.tgz

1. The payload attempts execution via npx, bunx, pnpx, or yarn dlx. This covers major JavaScript package managers. The retrieved package contrains a comprehensive credential stealer.

2. Harvested credentials are then encrpyted, using the keys as elsewhere in this campaign, and exfiltrated to checkmarx[.]zone/vsx as tpcp.tar.gz.

On non-CI systems, the malware installs persistence via a systemd user service. The persistence script polls https://checkmarx[.]zone/raw every 50 minutes for additional payloads, with a kill switch that aborts if the response contains “youtube”. Currently, the link redirects to The Show Must Go On by Queen.

Compromised Artifacts

OpenVSX Extensions

kics-github-action Releases

The v1.1 release was the only malicious release created. Other releases, triggered automatically by the tag events, failed because those versions already existed.

kics-github-action Tags

Which actions should security teams take?

1. Audit KICS GitHub Actions references: Review workflows using kics-github-action. If you referenced a version tag rather than a SHA, check workflow run logs from the exposure window for signs of compromise.

2. Search for exfiltration artifacts: Look for repositories named docs-tpcp in your GitHub organization, which may indicate successful exfiltration via the fallback mechanism.

Long-term hardening: Refer to Wiz’s How to Harden GitHub Actions: The Unofficial Guide

How can Wiz help?

Wiz customers should continue to monitor the advisory in the Wiz Threat Center for ongoing guidance, pre-built queries, and references to relevant detections they can use to assess the risk  in their environment.

Worried you’ve been impacted? Connect with the Wiz Incident Response team.