On 22 April 2026, researchers reported that official KICS artifacts, including a Docker image, a GitHub Action and two IDE extensions, were briefly poisoned to steal credentials. Within roughly a day, a malicious @bitwarden/cli version 2026.4.0 appeared on npm. Reports differ on exactly how.
What is confirmed about the KICS artifacts?
Trend Micro's analysis, published 13 May 2026, describes the KICS incident as multichannel poisoning across Docker Hub, VS Code and OpenVSX, and GitHub Actions. A practitioner write-up of the vendor's own bulletin lists the exposed items: the Docker image checkmarx/kics, the GitHub Action checkmarx/ast-github-action and two VS Code extensions, with the Docker window running about 28 minutes on 22 April and the Action window a little under one and a half hours. It says the vendor stated that malicious artifacts would not have replaced versions published before the windows.
That detail shapes your response. Exposure depends on when something was pulled, run or cached, not on whether you use the tool.
What happened to the Bitwarden CLI?
The Hacker News (23 April 2026) and Security Affairs (24 April) report that @bitwarden/cli 2026.4.0 contained malicious code run through an npm preinstall hook, which ran a loader and then a credential stealer. Trend Micro reports Bitwarden confirmed about 334 downloads over a 93 minute window.
The reports state the stolen data included GitHub and npm tokens, SSH keys, cloud credentials and environment files, and The Hacker News adds that AI coding tool configurations were targeted.
Where do the sources disagree?
On the mechanism. Trend Micro says stolen npm tokens from the KICS compromise were used to publish the package. JFrog and Socket, as reported by The Hacker News and Security Affairs, say the attack appeared to use a compromised GitHub Action in Bitwarden's own CI/CD pipeline, and Security Affairs adds a researcher's view that it was released through a trusted publishing workflow. Do not treat any single account as settled. Check the vendors' own advisories for the final account.
Why is a compromised scanner especially bad?
A scanner runs with broad access by design: it reads source, configuration and often cloud credentials. Run in CI, it sits next to deploy keys. Poisoning it harvests exactly what an attacker wants, and the tool is trusted enough that nobody questions its network calls.
What should you tell leadership?
Keep it factual. Say which artifacts were reported affected, the windows, whether your systems pulled them, and what you rotated. Say what you do not know yet, including that reports differ on the Bitwarden mechanism. Avoid naming a cause as certain.
Also say what you are changing: pinned digests, narrower credentials, restricted egress. A calm, specific note with those three parts earns more trust than a long account of the attacker's technique.
What to do
- Find out whether any of the named artifacts ran in your pipelines or on developer machines during the windows, using build logs and image digests.
- If yes, treat every secret reachable from that job as exposed and rotate it.
- Check whether a developer machine installed @bitwarden/cli 2026.4.0 and rotate GitHub, npm, cloud and SSH credentials from it.
- Pin images by digest and Actions by commit hash.
- Restrict outbound network access from CI jobs to what each step needs.
- Give CI jobs short-lived, narrowly scoped credentials.
- Review GitHub workflows for unexpected additions, since reports say stolen tokens were used to add workflows.
Constructed example: a team's nightly job pulls the scanner image by its latest tag. Build logs show a pull at 12:40 UTC on 22 April. The team rotates the cloud key that job could reach, reviews the audit log for use during that window and moves to a digest pin.
Safeguard's policies and gates and SBOM scanning can enforce pinning rules. Safeguard is also a security tool, so the same hygiene applies to it and to every tool in your pipeline.
Quick check
Am I affected if I use KICS?
Only if an affected artifact was pulled or run during the reported windows. Check logs and digests, and the vendor's bulletin.
Why not stop using scanners?
A scanner is still worth running. Limit its access, pin it and watch its network use like any other dependency.
Sources
- Trend Micro, Analyzing TeamPCP's Supply Chain Attacks (13 May 2026)
- Stéphane Robert, Checkmarx KICS compromised
- The Hacker News, Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign (23 April 2026)
- Security Affairs, Checkmarx supply chain attack impacts Bitwarden npm distribution path (24 April 2026)
Last reviewed: 18 October 2026.
