mcpAddon.js
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our follow-on analysis shows that the Checkmarx compromise includes a multi-stage credential theft and propagation component downloaded as mcpAddon.js . The initial infection vector is embedded directly in the compromised VS Code / Open VSX extensions... The malware harvests developer and cloud credentials, compresses and encrypts the results, and exfiltrates them both to an external endpoint and to threat actor-created public GitHub repositories under victim accounts.
Techniques & procedures
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
5 techniques
Initial Access
It also abuses stolen GitHub tokens to inject a new GitHub Actions workflow... and uses stolen npm credentials to identify writable packages for downstream republishing.
GitHub OIDC 토큰을 요청할 수 있는 id-token: write 권한도 보유하고 있었습니다... Azure 자격증명을 그대로 탈취
A threat actor compromised the pipeline(s) and distribution channels of two developer-tooling vendors... Malicious versions of Checkmarx KICS ... and the Bitwarden CLI ... were pushed to official channels and presented as legitimate releases.
On April 22, an attacker pushed malicious artifacts across three distribution channels... Docker Hub... Open VSX / VS Code extensions... GitHub Actions... Also on April 22, an attacker compromised a GitHub Action used in Bitwarden's CI/CD pipeline and published a trojanized @bitwarden/cli version 2026.4.0 to npm.
Execution
8 techniques
Execution
This JavaScript file mcpAddon.js is executed using the Bun interpreter; supporting execution on Windows and Unix-based systems.
It also launches a PowerShell command to enumerate Azure tokens of attached tenants: powershell.exe -NoProfile -NonInteractive -Command ...
Upon execution of mcpAddon.js, Bun launches the following commands on Windows systems: C:\WINDOWS\system32\cmd.exe /d /s /c "gh auth token" ...
mcpAddon.js functions as a stand-alone token stealer which uses the victim’s shell (PowerShell or Bash) to enumerate and exfiltrate the following...
The attacker added a hidden ‘MCP addon’ feature that pulled a ~10MB payload ( mcpAddon.js ) from a hardcoded GitHub URL and executed it via the Bun runtime on extension activation... A preinstall hook invoked a loader ( bw_setup.js ) that downloaded the Bun runtime and launched an obfuscated second-stage payload ( bw1.js ).
This JavaScript file mcpAddon.js is executed using the Bun interpreter...
Persistence
3 techniques
Persistence
It also abuses stolen GitHub tokens to inject a new GitHub Actions workflow... and uses stolen npm credentials to identify writable packages for downstream republishing.
Privilege Escalation
3 techniques
Privilege Escalation
It also abuses stolen GitHub tokens to inject a new GitHub Actions workflow... and uses stolen npm credentials to identify writable packages for downstream republishing.
Stealth
6 techniques
Stealth
Obfuscation Techniques (mcpAddon.js) A giant one-line bundle with mangled identifiers... A string-table decoder... Additional scrambled string decoding... Multiple gzip+base64 embedded payloads...
It also abuses stolen GitHub tokens to inject a new GitHub Actions workflow... and uses stolen npm credentials to identify writable packages for downstream republishing.
GitHub OIDC 토큰을 요청할 수 있는 id-token: write 권한도 보유하고 있었습니다... Azure 자격증명을 그대로 탈취
Credential Access
4 techniques
Credential Access
This workflow uses a clever trick—${{ toJSON(secrets) }}—to collapse every secret in the repository into a single string
mcpAddon.js is designed to sweep development environments for high-value secrets, including GitHub tokens, npm tokens, AWS/Azure/GCP credentials, SSH keys, environment variables, and configuration files for Claude and other AI tools.
Both malicious payloads attempted to harvest the following sensitive information: GitHub and npm tokens SSH keys Cloud provider credentials AI assistant configurations
Both malicious payloads attempted to harvest the following sensitive information: GitHub and npm tokens SSH keys Cloud provider credentials AI assistant configurations... mcpAddon.js is designed to sweep development environments for high-value secrets, including GitHub tokens, npm tokens, AWS/Azure/GCP credentials, SSH keys...
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Command and Control
1 technique
Command and Control
The attacker added a hidden ‘MCP addon’ feature that pulled a ~10MB payload ( mcpAddon.js ) from a hardcoded GitHub URL... A preinstall hook invoked a loader ( bw_setup.js ) that downloaded the Bun runtime and launched an obfuscated second-stage payload ( bw1.js ).
Exfiltration
4 techniques
Exfiltration
수집된 데이터는 압축 및 암호화되어 audit.checkmarx[.]cx/v1/telemetry 라는 외부 서버로 전송됩니다.
This harvested data is then exfiltrated to hxxps://audit[.]checkmarx[.]cx/v1/telemetry ... the attacker created public repositories in victim GitHub accounts and stored the encrypted stolen data inside them – essentially using the victim's own infrastructure as a dead drop.
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A heavily obfuscated JavaScript credential stealer delivered as a second-stage payload via trojanized Checkmarx VS Code/Open VSX extensions. It steals GitHub, cloud, npm, SSH, and environment secrets, exfiltrates them to attacker infrastructure, and abuses stolen GitHub tokens to inject malicious GitHub Actions workflows for further secret theft and supply-chain propagation.
A multi-stage credential-stealing malware component delivered via compromised Checkmarx VS Code/Open VSX extensions. It executes through the Bun runtime, harvests GitHub, AWS, Azure, GCP, npm, SSH, environment, and MCP-related secrets, exfiltrates them over HTTPS and via attacker-created public GitHub repositories, injects malicious GitHub Actions workflows to steal repository secrets, and abuses stolen npm credentials to republish malicious packages for further propagation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.