Likelihood: HIGH
Impact: VERY HIGH
Treatment: MITIGATE
Confidence: Moderate
Likelihood is high because the malicious artifacts were live across three simultaneous distribution channels for 90 minutes, creating a concrete, time-bounded exposure window during which any automated pipeline pull would have silently ingested credential-harvesting code — no user interaction or additional exploitation step required; impact is very high because the stolen artifacts target cloud provider credentials and CI/CD secrets that grant authenticated, privileged access to production infrastructure, enabling data exfiltration, infrastructure destruction, ransomware deployment, and cascading lateral movement into source control and downstream environments.
Treatment rationale: The threat is active, the exposure window is defined, and the attack surface (credential compromise across cloud and CI/CD) is too high-consequence and too broadly distributed across pipeline dependencies to transfer or accept — immediate containment, credential rotation, and pipeline artifact validation are the only viable primary response.
Third-Party / Supply-Chain Risk
This is a supply-chain compromise of a widely adopted open-source IaC scanning toolchain (Checkmarx KICS) distributed through three shared public repositories — Docker Hub, VS Code Marketplace, and Open VSX. Per NIST SP 800-161, organizations face Tier 2 and Tier 3 supplier risk: the compromised component was embedded in developer pipelines as a trusted dependency, meaning the attack bypassed first-party security controls entirely by weaponizing a trusted upstream artifact. Any organization whose CI/CD pipeline consumed KICS artifacts during the April 22, 2026 window — including through automated dependency pulls in containerized build environments — should be treated as exposed regardless of their own security posture. Secondary exposure exists through the Checkmarx ast-github-action and Developer Assist extension, which may be present in GitHub Actions workflows and developer workstations respectively, extending the blast radius beyond build servers to individual engineer endpoints.
Loss Exposure (illustrative)
Magnitude: Very high — illustrative $500K–$5M+ per exposed organization, scalable with cloud footprint and data sensitivity
Frequency: For an organization that consumed affected artifacts during the 90-minute window: this is a single, discrete, already-realized exposure event, not a recurring frequency scenario; probability of loss realization is treated as near-certain for confirmed consumers of the malicious artifacts pending credential rotation
Annualized: Not meaningful as an annualized figure — this is a single-event supply-chain compromise with immediate loss potential; the relevant frame is total loss exposure from this event, illustratively $500K–$5M+ depending on cloud spend at risk, regulated data in scope, and incident response costs, not an annual recurrence calculation
Basis: Range is derived from four primary loss factors specific to this threat: (1) incident response and forensic investigation costs for pipeline triage, artifact validation, and credential rotation across cloud, GitHub, and SSH surfaces — typically the floor of any cloud credential compromise; (2) potential unauthorized cloud resource provisioning or destruction during any window between credential theft and revocation, scaled to the organization's cloud footprint; (3) regulatory exposure if stolen credentials accessed environments containing regulated data, which adds notification, legal, and potential fine exposure; (4) reputational and customer-notification costs if the compromise reached customer-facing systems or software artifacts. Upper range reflects organizations with large cloud footprints, regulated data, or customer software delivery pipelines. Lower range reflects organizations with rapid detection and limited cloud exposure during the window.
Illustrative estimate — not actuarially derived.
Insurance / Contractual / Legal — Potential Obligations
Potential triggers, not legal determinations. Verify with counsel/broker before acting.
• Confirmed or suspected exfiltration of cloud credentials, GitHub tokens, or SSH keys may trigger cyber-insurance incident-notification obligations — verify with broker before remediation actions alter forensic evidence.
• If compromised credentials accessed environments containing PII, PHI, or regulated data, this event may constitute a reportable breach under applicable state, federal, or international breach-notification frameworks — verify with counsel before any disclosure decisions.
• CI/CD pipeline compromise affecting software artifacts delivered to customers may invoke software supply-chain contractual warranties or notification clauses in customer agreements — verify with counsel.
• Cloud provider terms of service and shared-responsibility agreements may impose notification or cooperation obligations if provider infrastructure was accessed via stolen credentials — verify with counsel and relevant cloud provider account teams.
