# Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure

> Within a 5-hour window on 22 April 2026, threat actors trojanised the Checkmarx KICS scanner (Docker, Open VSX, GitHub Actions) and the @bitwarden/cli 2026.4.0 npm package. Both intrusions beacon to the same impersonating C2 audit.checkmarx[.]cx (94.154.172.43), exfiltrating CI/CD secrets, cloud credentials, GitHub/npm tokens, SSH keys, and AI-tool configurations using AES-256-GCM-encrypted payloads launched via the Bun runtime. Attribution links the Checkmarx leg to TeamPCP (@pcpcats) and the broader Shai-Hulud: The Third Coming worm campaign.

- **Published:** 2026-04-25T12:00:00Z
- **Last reviewed:** 2026-04-25T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0424
- **ID:** TL-2026-0424
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 22 April 2026, Sophos X-Ops, Socket, JFrog, and Aikido Security identified two coordinated supply-chain compromises hitting the trust chain that sits between developers and their CI/CD pipelines. The first wave targeted Checkmarx, where attackers pushed malicious artefacts to the company's Docker Hub repository (KICS tags v2.1.20, v2.1.20-debian, v2.1.21, debian, alpine, latest), to two Open VSX extensions (cx-dev-assist 1.17.0/1.19.0 and ast-results 2.63.0/2.66.0), and to the checkmarx/ast-github-action @ tag 2.3.35 used inside Bitwarden's CI/CD pipeline. The KICS Go binary was modified to add a telemetry routine that AES-256-GCM-encrypted SAST scan reports and exfiltrated them to https://audit.checkmarx[.]cx/v1/telemetry; the VS Code extensions deployed an approximately 10 MB obfuscated JavaScript payload (mcpAddon.js) executed under the Bun runtime, with backdated Git commits used to hide the malicious diffs.

Within hours, the same actor leveraged the compromised checkmarx/ast-github-action to inject malicious code into Bitwarden's release workflow, publishing a trojanised @bitwarden/cli@2026.4.0 to the public npm registry between 17:57 and 19:30 ET (a ~93-minute exposure window). The malicious package shipped a preinstall hook that invoked bw_setup.js, which downloaded the Bun runtime and decoded a second-stage 10 MB payload (bw1.js) via __decodeScrambled with seed 0x3039. bw1.js dropped a lockfile at /tmp/tmp.987654321.lock, staged data in /tmp/_tmp_<unix_epoch>/, packaged exfiltration archives as package-updated.tgz, and harvested GitHub PATs (memory-scraped from running gh/git processes), npm tokens from .npmrc, AWS credentials from ~/.aws/, Azure and GCP credentials, SSH keys, environment variables, shell history, AWS SSM/Secrets Manager and Azure Key Vault/GCP Secret Manager material, and configuration files for Claude, Cursor, Kiro, Codex CLI, Aider, and other MCP-enabled AI assistants. Persistence was established by appending loader stubs to ~/.bashrc and ~/.zshrc; an execution guardrail aborted on Russian system locales (LC_ALL, LC_MESSAGES, LANGUAGE, LANG). A worm component re-used stolen GitHub tokens to inject malicious workflows into accessible private repositories and to mirror exfiltrated data to attacker-controlled GitHub commits as a fallback channel.

Both payloads share the audit.checkmarx[.]cx/v1/telemetry endpoint resolving to 94.154.172.43, AES-256-GCM, the Bun runtime loader pattern, and Dune-themed naming conventions ({word}-{word}-{3digits}, e.g. atreides, fremen, harkonnen, melange, sandworm) embedded in the binary alongside the strings ''Shai-Hulud: The Third Coming'' and ''Butlerian Jihad'' manifesto references — tying the cluster to prior Shai-Hulud npm-worm activity. The Checkmarx intrusion was publicly claimed by TeamPCP through the @pcpcats account (since suspended); operational tradecraft differences between the two waves leave the Bitwarden leg attributed only to the Shai-Hulud cluster. Bitwarden remediated by yanking 2026.4.0, releasing 2026.4.1, and confirming no production or vault data was accessed; only ~334 users downloaded the malicious package. Sophos detections are JS/Steal-EAP, JS/Agent-BLZZ, and Linux/Agnt-HZ.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.003 User Execution: Malicious Image
- T1620 Reflective Code Loading
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1480.001 Environmental Keying
- T1070.006 Indicator Removal: Timestomp
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1583.001 Acquire Infrastructure: Domains
- T1587.001 Develop Capabilities: Malware
- T1531 Account Access Removal

## Sources

- [Sophos News: Supply chain attacks hit Checkmarx and Bitwarden developer tools](https://www.sophos.com/en-us/blog/supply-chain-attacks-hit-checkmarx-and-bitwarden-developer-tools)
- [Socket: Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign](https://socket.dev/blog/bitwarden-cli-compromised)
- [The Hacker News: Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html)
- [Bitwarden Community: Statement on Checkmarx Supply Chain Incident](https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127)
- [Security Affairs: Checkmarx supply chain attack impacts Bitwarden npm distribution path](https://securityaffairs.com/191215/uncategorized/checkmarx-supply-chain-attack-impacts-bitwarden-npm-distribution-path.html)
- [Security Boulevard: Bitwarden CLI Compromise Linked to Ongoing Checkmarx Supply Chain Campaign](https://securityboulevard.com/2026/04/bitwarden-cli-compromise-linked-to-ongoing-checkmarx-supply-chain-campaign/)
- [CyberInsider: Bitwarden CLI backdoored in Checkmarx supply chain attack](https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack/)
- [SC Media: Checkmarx supply chain hack impacts Bitwarden CLI](https://www.scworld.com/brief/checkmarx-supply-chain-hack-impacts-bitwarden-cli)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0424