Checkmarx has confirmed that data linked to its internal GitHub repositories was published by a cybercriminal group, widening scrutiny of a March supply chain attack that affected developer tools used across software build environments.
The application security company said its investigation indicates that repository access was enabled by the 23 March 2026 attack connected to the Trivy supply chain compromise. Data exfiltration is believed to have taken place on 30 March, before LAPSUS$ released Checkmarx-linked material on 25 April. The disclosure has raised concern because Checkmarx provides code security and software composition analysis tools to enterprises that depend on trusted development pipelines.
Checkmarx has said its GitHub repositories are maintained separately from its customer production environment and that customer data is not stored there as standard practice. That position narrows the immediate concern over direct customer-record exposure, but it does not remove the risk that source code, internal tooling details, workflow information or credentials could aid follow-on attacks. The company said forensic work is continuing to verify the nature and scope of the posted data.
Udi-Yehuda Tamar, Checkmarx’s VP of Platform Engineering and Global CISO, has been the named executive on the company’s incident updates. The company’s timeline shows that malicious artefacts were first published on 23 March, when attackers pushed code into Checkmarx’s GitHub environment. The affected items included two OpenVSX extensions and two GitHub Actions workflows, both important channels for developer automation and application security scanning.
The OpenVSX exposure involved ast-results-2.53.0. vsix and cx-dev-assist-1.7.0. vsix. Checkmarx said organisations that downloaded and ran those extensions from OpenVSX between 02:53 UTC and 15:41 UTC on 23 March may have been affected. Separately, malicious payloads were injected into checkmarx/ast-github-action and checkmarx/kics-github-action between 12:58 UTC and 16:50 UTC the same day.
The company has advised affected users to uninstall malicious components, move to verified releases, review workflow runs, search for suspicious indicators, and rotate credentials that may have been accessible to CI runners. Potentially affected secrets include GitHub personal access tokens, cloud service credentials and repository-level or organisation-level credentials.
Checkmarx later identified another wave of compromised artefacts on 22 April, which pointed to persistence or renewed attacker access. The 25 April publication of stolen data then shifted the incident from a supply chain compromise into a broader data exposure case. Access to affected GitHub repositories has been locked down while the investigation continues, and the company has engaged outside forensic specialists, breach counsel, law enforcement and Mandiant to support its response.
Security researchers have linked the broader campaign to TeamPCP, a threat actor associated with credential-stealing attacks against software development infrastructure. The group’s tactics have focused on trusted tools inside CI/CD pipelines, where a single compromised action, package or extension can harvest secrets from downstream users and potentially move across other repositories or cloud environments.
The Checkmarx case reflects a growing pattern in which security tools themselves become high-value targets. Attackers are increasingly seeking access to automated build systems, package publishing tokens, GitHub Actions workflows and developer extensions rather than attacking finished applications alone. These systems often hold privileged credentials and are trusted by developers, making them attractive points for supply chain compromise.
The incident also follows wider concern over poisoned software packages and compromised developer utilities. The Bitwarden CLI package was temporarily affected in a connected campaign on 22 April, when a trojanised npm release appeared for a short window before containment. Security teams have treated such events as evidence that attackers are moving quickly between vendors, registries and automation tools.
For Checkmarx, the central challenge is now twofold: proving that attacker access has been fully contained and establishing whether any sensitive internal material in the leaked dataset can enable further compromise. The company has said it is conducting a code audit to verify that no malicious code remains beyond already identified findings. It has also rotated potentially exposed credentials, added access restrictions, strengthened development workflow controls and reviewed integrations.
Enterprises using Checkmarx products are likely to focus on whether they downloaded affected artefacts, whether their CI/CD systems ran the compromised workflows, and whether any secrets were exposed during the relevant windows. The most urgent remediation steps are credential rotation, log review, repository audit and verification that only clean versions of Checkmarx Actions and extensions remain in use.
Publicly available details do not show confirmed exposure of customer production data. The greater risk lies in the way the breach demonstrates how attackers can turn development infrastructure into a distribution channel. For software security vendors, the episode places pressure on release integrity, signed artefacts, isolated build systems, token minimisation and faster public incident communication when trusted developer tools are poisoned.
The application security company said its investigation indicates that repository access was enabled by the 23 March 2026 attack connected to the Trivy supply chain compromise. Data exfiltration is believed to have taken place on 30 March, before LAPSUS$ released Checkmarx-linked material on 25 April. The disclosure has raised concern because Checkmarx provides code security and software composition analysis tools to enterprises that depend on trusted development pipelines.
Checkmarx has said its GitHub repositories are maintained separately from its customer production environment and that customer data is not stored there as standard practice. That position narrows the immediate concern over direct customer-record exposure, but it does not remove the risk that source code, internal tooling details, workflow information or credentials could aid follow-on attacks. The company said forensic work is continuing to verify the nature and scope of the posted data.
Udi-Yehuda Tamar, Checkmarx’s VP of Platform Engineering and Global CISO, has been the named executive on the company’s incident updates. The company’s timeline shows that malicious artefacts were first published on 23 March, when attackers pushed code into Checkmarx’s GitHub environment. The affected items included two OpenVSX extensions and two GitHub Actions workflows, both important channels for developer automation and application security scanning.
The OpenVSX exposure involved ast-results-2.53.0. vsix and cx-dev-assist-1.7.0. vsix. Checkmarx said organisations that downloaded and ran those extensions from OpenVSX between 02:53 UTC and 15:41 UTC on 23 March may have been affected. Separately, malicious payloads were injected into checkmarx/ast-github-action and checkmarx/kics-github-action between 12:58 UTC and 16:50 UTC the same day.
The company has advised affected users to uninstall malicious components, move to verified releases, review workflow runs, search for suspicious indicators, and rotate credentials that may have been accessible to CI runners. Potentially affected secrets include GitHub personal access tokens, cloud service credentials and repository-level or organisation-level credentials.
Checkmarx later identified another wave of compromised artefacts on 22 April, which pointed to persistence or renewed attacker access. The 25 April publication of stolen data then shifted the incident from a supply chain compromise into a broader data exposure case. Access to affected GitHub repositories has been locked down while the investigation continues, and the company has engaged outside forensic specialists, breach counsel, law enforcement and Mandiant to support its response.
Security researchers have linked the broader campaign to TeamPCP, a threat actor associated with credential-stealing attacks against software development infrastructure. The group’s tactics have focused on trusted tools inside CI/CD pipelines, where a single compromised action, package or extension can harvest secrets from downstream users and potentially move across other repositories or cloud environments.
The Checkmarx case reflects a growing pattern in which security tools themselves become high-value targets. Attackers are increasingly seeking access to automated build systems, package publishing tokens, GitHub Actions workflows and developer extensions rather than attacking finished applications alone. These systems often hold privileged credentials and are trusted by developers, making them attractive points for supply chain compromise.
The incident also follows wider concern over poisoned software packages and compromised developer utilities. The Bitwarden CLI package was temporarily affected in a connected campaign on 22 April, when a trojanised npm release appeared for a short window before containment. Security teams have treated such events as evidence that attackers are moving quickly between vendors, registries and automation tools.
For Checkmarx, the central challenge is now twofold: proving that attacker access has been fully contained and establishing whether any sensitive internal material in the leaked dataset can enable further compromise. The company has said it is conducting a code audit to verify that no malicious code remains beyond already identified findings. It has also rotated potentially exposed credentials, added access restrictions, strengthened development workflow controls and reviewed integrations.
Enterprises using Checkmarx products are likely to focus on whether they downloaded affected artefacts, whether their CI/CD systems ran the compromised workflows, and whether any secrets were exposed during the relevant windows. The most urgent remediation steps are credential rotation, log review, repository audit and verification that only clean versions of Checkmarx Actions and extensions remain in use.
Publicly available details do not show confirmed exposure of customer production data. The greater risk lies in the way the breach demonstrates how attackers can turn development infrastructure into a distribution channel. For software security vendors, the episode places pressure on release integrity, signed artefacts, isolated build systems, token minimisation and faster public incident communication when trusted developer tools are poisoned.
Topics
Technology