Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure

Coordinated supply chain attacks on Checkmarx and Bitwarden (TL-2026-0424), also tracked as Shai-Hulud: The Third Coming, is a high-severity supply-chain compromise, first published 2026-04-25. It is attributed to TeamPCP with medium confidence, affects Bitwarden @bitwarden/cli (npm), maps to 28 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0424

Threat ID
TL-2026-0424
Also known as
Shai-Hulud: The Third Coming, Checkmarx-Bitwarden supply chain attack, TeamPCP campaign
Severity
HIGH
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-25
Last reviewed
2026-04-25
Attribution
TeamPCP
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development, financial, cryptocurrency, devsecops, managed-service-providers, enterprise
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
30

Malware and tooling in Coordinated supply chain attacks on Checkmarx and Bitwarden

Malware and tooling: JS/Agent-BLZZ, JS/Steal-EAP, Linux/Agnt-HZ, Shai-Hulud, Bun JavaScript runtime

Within a 5-hour window on 22 April 2026, threat actors trojanised the Checkmarx KICS scanner (Docker, Open VSX, GitHub Actions) and the @bitwarden/cli 2026.4.0 npm package. Both intrusions beacon to the same impersonating C2 audit.checkmarx[.]cx (94.154.172.43), exfiltrating CI/CD secrets, cloud credentials, GitHub/npm tokens, SSH keys, and AI-tool configurations using AES-256-GCM-encrypted payloads launched via the Bun runtime. Attribution links the Checkmarx leg to TeamPCP (@pcpcats) and the broader Shai-Hulud: The Third Coming worm campaign.

How Coordinated supply chain attacks on Checkmarx and Bitwarden works

On 22 April 2026, Sophos X-Ops, Socket, JFrog, and Aikido Security identified two coordinated supply-chain compromises hitting the trust chain that sits between developers and their CI/CD pipelines. The first wave targeted Checkmarx, where attackers pushed malicious artefacts to the company's Docker Hub repository (KICS tags v2.1.20, v2.1.20-debian, v2.1.21, debian, alpine, latest), to two Open VSX extensions (cx-dev-assist 1.17.0/1.19.0 and ast-results 2.63.0/2.66.0), and to the checkmarx/ast-github-action @ tag 2.3.35 used inside Bitwarden's CI/CD pipeline. The KICS Go binary was modified to add a telemetry routine that AES-256-GCM-encrypted SAST scan reports and exfiltrated them to https://audit.checkmarx[.]cx/v1/telemetry; the VS Code extensions deployed an approximately 10 MB obfuscated JavaScript payload (mcpAddon.js) executed under the Bun runtime, with backdated Git commits used to hide the malicious diffs.

Within hours, the same actor leveraged the compromised checkmarx/ast-github-action to inject malicious code into Bitwarden's release workflow, publishing a trojanised @bitwarden/cli@2026.4.0 to the public npm registry between 17:57 and 19:30 ET (a ~93-minute exposure window). The malicious package shipped a preinstall hook that invoked bw_setup.js, which downloaded the Bun runtime and decoded a second-stage 10 MB payload (bw1.js) via __decodeScrambled with seed 0x3039. bw1.js dropped a lockfile at /tmp/tmp.987654321.lock, staged data in /tmp/_tmp_<unix_epoch>/, packaged exfiltration archives as package-updated.tgz, and harvested GitHub PATs (memory-scraped from running gh/git processes), npm tokens from .npmrc, AWS credentials from ~/.aws/, Azure and GCP credentials, SSH keys, environment variables, shell history, AWS SSM/Secrets Manager and Azure Key Vault/GCP Secret Manager material, and configuration files for Claude, Cursor, Kiro, Codex CLI, Aider, and other MCP-enabled AI assistants. Persistence was established by appending loader stubs to ~/.bashrc and ~/.zshrc; an execution guardrail aborted on Russian system locales (LC_ALL, LC_MESSAGES, LANGUAGE, LANG). A worm component re-used stolen GitHub tokens to inject malicious workflows into accessible private repositories and to mirror exfiltrated data to attacker-controlled GitHub commits as a fallback channel.

Both payloads share the audit.checkmarx[.]cx/v1/telemetry endpoint resolving to 94.154.172.43, AES-256-GCM, the Bun runtime loader pattern, and Dune-themed naming conventions ({word}-{word}-{3digits}, e.g. atreides, fremen, harkonnen, melange, sandworm) embedded in the binary alongside the strings ''Shai-Hulud: The Third Coming'' and ''Butlerian Jihad'' manifesto references — tying the cluster to prior Shai-Hulud npm-worm activity. The Checkmarx intrusion was publicly claimed by TeamPCP through the @pcpcats account (since suspended); operational tradecraft differences between the two waves leave the Bitwarden leg attributed only to the Shai-Hulud cluster. Bitwarden remediated by yanking 2026.4.0, releasing 2026.4.1, and confirming no production or vault data was accessed; only ~334 users downloaded the malicious package. Sophos detections are JS/Steal-EAP, JS/Agent-BLZZ, and Linux/Agnt-HZ.

MITRE ATT&CK techniques used in TL-2026-0424

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1070.006 Indicator Removal: Timestomp; T1140 Deobfuscate/Decode Files or Information; T1480.001 Environmental Keying

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.003 User Execution: Malicious Image

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores

Impact

T1531 Account Access Removal

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1587.001 Develop Capabilities: Malware

stealth

T1620 Reflective Code Loading

Affected products and versions in Coordinated supply chain attacks on Checkmarx and Bitwarden

  • Bitwarden — @bitwarden/cli (npm)
    Vulnerable versions: 2026.4.0
    Fixed in: 2026.4.1
  • Checkmarx — KICS (Docker Hub)
    Vulnerable versions: v2.1.20; v2.1.20-debian; v2.1.21; debian; alpine; latest
    Fixed in: pending vendor advisory
  • Checkmarx — cx-dev-assist (Open VSX VS Code extension)
    Vulnerable versions: 1.17.0; 1.19.0
    Fixed in: pending vendor advisory
  • Checkmarx — ast-results (Open VSX VS Code extension)
    Vulnerable versions: 2.63.0; 2.66.0
    Fixed in: pending vendor advisory
  • Checkmarx — ast-github-action (GitHub Actions)
    Vulnerable versions: 2.3.35
    Fixed in: pin to pre-2026-04-22 commit SHA

Remediation for Coordinated supply chain attacks on Checkmarx and Bitwarden

Patches

  • Bitwarden CLI 2026.4.1 (npm) — released ~2 hours after detection
  • Checkmarx KICS — pull only signed images published before 2026-04-22 17:00 ET pending vendor advisory

Immediate actions

  • Uninstall @bitwarden/cli 2026.4.0: npm uninstall -g @bitwarden/cli && npm cache clean --force
  • Remove Checkmarx KICS Docker images tagged v2.1.20, v2.1.20-debian, v2.1.21, debian, alpine, latest published on or after 2026-04-22
  • Pin checkmarx/ast-github-action to a SHA known-good before 2026-04-22 and uninstall tag 2.3.35
  • Remove Open VSX extensions Checkmarx.cx-dev-assist 1.17.0/1.19.0 and Checkmarx.ast-results 2.63.0/2.66.0
  • Block egress to audit.checkmarx[.]cx and 94.154.172.43 at the perimeter and on developer endpoints
  • Rotate every GitHub PAT, npm token, SSH key, and cloud credential (AWS/Azure/GCP) exposed on hosts that ran the malicious artefacts
  • Audit GitHub Actions run logs and recent commits for unauthorised workflow injections from rotated tokens

Workarounds

  • Temporarily set npm config ignore-scripts=true
  • Block resolution of audit.checkmarx[.]cx via DNS sinkhole
  • Quarantine any host that ran the trojanised artefacts and treat all secrets on it as compromised

Longer-term hardening

  • Pin all third-party GitHub Actions to immutable commit SHAs rather than mutable tags (per GitHub security hardening guidance)
  • Disable npm install scripts by default in CI (npm config set ignore-scripts true) and explicitly allowlist trusted packages
  • Require signed/provenance-verified npm publishes and enforce npm audit signatures in release pipelines
  • Move developer secrets out of plaintext .env / .npmrc / ~/.aws and into short-lived OIDC-issued credentials
  • Enforce egress allowlists on developer workstations and CI runners; alert on first-seen domains
  • Add EDR coverage that flags Bun runtime invocation from npm preinstall hooks and unexpected child processes from VS Code extensions

Weaknesses (CWE) in Coordinated supply chain attacks on Checkmarx and Bitwarden

CWE-506, CWE-829, CWE-494, CWE-1357

Timeline of Coordinated supply chain attacks on Checkmarx and Bitwarden

  • Bitwarden CLI 2026.4.1 published to npm as a clean replacement approximately 2 hours after detection.
  • Bitwarden CLI 2026.4.0 deprecated on npm at 19:30 ET after a ~93-minute exposure window; only ~334 users downloaded the malicious package.
  • Both payloads beacon to https://audit.checkmarx[.]cx/v1/telemetry (94.154.172.43); credentials, cloud secrets, GitHub/npm tokens, SSH keys, and AI assistant configurations are encrypted with AES-256-GCM and exfiltrated.
  • Trojanised @bitwarden/cli 2026.4.0 published to npm at 17:57 ET; preinstall hook downloads Bun runtime via bw_setup.js and launches obfuscated bw1.js.
  • checkmarx/ast-github-action tag 2.3.35 is updated with malicious code, poisoning Bitwarden's CI/CD pipeline that depends on it.
  • Trojanised KICS Docker images (v2.1.20, v2.1.20-debian, v2.1.21, debian, alpine, latest) and Open VSX extensions cx-dev-assist 1.17.0/1.19.0 and ast-results 2.63.0/2.66.0 are pushed to public registries with backdated Git commits.
  • Bitwarden, Socket, JFrog, The Hacker News, and Aikido Security publish technical write-ups; CVE issued for @bitwarden/cli 2026.4.0.
  • TeamPCP claims the Checkmarx leg of the campaign via the @pcpcats X account; the account is subsequently suspended.
  • Researchers correlate embedded strings (''Shai-Hulud: The Third Coming'', ''Butlerian Jihad'') and Dune-themed naming conventions to the ongoing Shai-Hulud npm-worm campaign cluster.
  • Sophos X-Ops publishes the unified Checkmarx + Bitwarden analysis confirming shared C2 infrastructure (audit.checkmarx[.]cx, 94.154.172.43) and Sophos detections JS/Steal-EAP, JS/Agent-BLZZ, Linux/Agnt-HZ.
  • As of 2026-05-29, this specific Checkmarx/Bitwarden incident is contained (Bitwarden CLI 2026.4.1 shipped, @pcpcats suspended, C2 known), but TeamPCP/Shai-Hulud remains live and escalating. The crew open-sourced its worm (May 12-13), poisoned 400+ packages May 11, and breached GitHub (~3,800 repos, May 20) — no arrests or takedown.

Sources cited for Coordinated supply chain attacks on Checkmarx and Bitwarden

Threats related to Coordinated supply chain attacks on Checkmarx and Bitwarden

Detection coverage for TL-2026-0424

As of 2026-04-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0424 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats