Checkmarx Confirms GitHub Data Leak on Dark Web Following March Supply Chain Attack

For the Moroccan tech community—from the startups in Casablanca to the dev teams in Rabat—the security of our supply chains is more critical than ever. Recently, Checkmarx, a major player in the application security space, confirmed that data from its GitHub repositories has been published on the dark web. This leak is a direct consequence of a sophisticated supply chain attack that began on March 23, 2026, and serves as a vital case study in how modular modern development can be exploited.

TL;DR

Checkmarx has confirmed that data leaked on the dark web originated from its GitHub repository, which was accessed during a March 2026 supply chain attack. While the leak reportedly includes source code, API keys, and employee data, the company maintains that customer production environments remain separate and unaffected. Security teams should be aware that this incident involved tampered VS Code extensions and GitHub Actions used to spread credential-stealing malware.

---

Anatomy of the Attack: From Supply Chain to Data Leak

The trouble began on March 23, 2026, when Checkmarx fell victim to a supply chain attack. In a supply chain attack, hackers target a third-party service or a development tool rather than the company's main servers directly. In this case, the attackers (initially identified as TeamPCP) tampered with Checkmarx's GitHub Actions workflows and plugins distributed via the Open VSX marketplace.

By late April, specifically April 26, 2026, it became clear that this initial access led to a significant data breach. Checkmarx confirmed that a cybercriminal group had published company data on the dark web. According to the company’s investigation, the "initial supply chain attack" provided the gateway for the threat actors to access and exfiltrate data from their GitHub repository.

What Was Compromised?

While Checkmarx is still performing a forensic probe to verify the exact nature of the leak, "Dark Web Informer" reported that the LAPSUS$ group claimed responsibility for the posting. This creates some uncertainty regarding attribution, as TeamPCP originally claimed the supply chain breach, while LAPSUS$ is linked to the data leak.

The data listing reportedly includes:

• Source code from various projects.
• Employee databases.
• API keys (which act as digital "passports" allowing software to talk to other services).
• Database credentials for MongoDB and MySQL.

Impacts on Developer Tools

This incident is particularly relevant for Moroccan developers because it involved tools many of us use daily. The investigation revealed that the attackers successfully compromised:

1. Two VS Code extensions: Small programs that add features to the Visual Studio Code editor.
2. KICS Docker image: A tool used to find security vulnerabilities in Infrastructure as Code (IaC).
3. GitHub Actions workflows: Automation scripts that handle CI/CD (Continuous Integration/Continuous Deployment) processes.

These components were injected with credential-stealing malware. This malware was designed to harvest secrets from the developer’s local environment. The attack even had a cascading effect, leading to a brief compromise of the Bitwarden CLI npm package.

Separation of Environments

One crucial detail for organizations currently using Checkmarx products is the separation of infrastructure. Checkmarx has explicitly stated that its GitHub repository is maintained separately from its customer production environment.

Crucially, the company claims that no customer data is stored in the affected repository. This is a standard security practice known as "segmentation," which ensures that a breach in the development lab doesn't necessarily mean a breach of the production warehouse.

Mitigation and Current Status

In response to the incident, Checkmarx has taken several immediate steps:

• Lockdown: Access to the affected GitHub repository has been terminated.
• Forensic Investigation: A deep-dive probe is ongoing to determine if any customer information was touched.
• Transparency: The company has committed to notifying customers and relevant parties immediately if it is determined that their information was involved.

Key Takeaways for the Moroccan Tech Community

This incident highlights that even security companies are not immune to supply chain risks. For local sysadmins and developers, this is a reminder to:

1. Audit GitHub Actions: Ensure you are using "pinned" versions of actions (using a specific SHA hash) rather than just a version tag.
2. Monitor Marketplace Plugins: Be cautious with VS Code extensions and other marketplace tools, as they can be vectors for malware.
3. Restrict Secrets: Never store production secrets or sensitive API keys in repositories where they are not absolutely necessary.

The scope of this leak is still being determined, and we will update this space as more verified information becomes available from the forensic probe.

---

Source: The Hacker News - Checkmarx Confirms GitHub Repository Data Posted on Dark Web