Four days passed between initial access and discovery [16]. Then thirty more days passed before the last evidence of threat actor activity, on April 22 [17][9]. Remediation ran for a month while the actor was still resident, which is unremarkable for an intrusion that included developer workstations [8], and that same month is when the release channels were being cleaned.
The advisory names three artifact classes for a reason [4]. A VS Code extension executes in the developer's editor session, with that developer's filesystem and frequently their tokens. An Actions workflow executes in CI with whatever the job's credentials can reach. A Jenkins plugin executes inside the controller. None of the three gets read per release by the team consuming it, which is why shipping through them is appealing.
The confirmations Checkmarx published on June 4 [15] share a subject. Production AWS, the Checkmarx One SaaS environment, the GitHub environment, the workstations [7][8]. Every one of them is a statement about Checkmarx's estate. The question a customer actually has is which build of which extension landed on which machine, and in which week.
The company says it removed the malicious artifacts, published clean verified replacements across all affected channels [10], and blocked outbound access to attacker-controlled infrastructure [11]. Both are correct vendor-side moves, and neither of them tells you whether one of your laptops pulled a poisoned build. To scope that, you need artifact names, version ranges and hashes, plus the destinations that were blocked. In the summary as published, the heading marked Timeline is followed by no dated entries, and none of those indicators appear anywhere in the document [19].
The hardening list reads like people who took the finding seriously: CI/CD pipeline security tooling, access management controls, credential rotation, and increased monitoring and detection [13]. Access to the affected repositories was locked down and law enforcement was engaged [12]. There is also a code audit to verify no further malicious code is present beyond what was already found [14], an unusual admission for a company to make about its own repositories. The document is less settled about its own status than the headline suggests: one section describes the company as being in the final stages of the investigation, another declares it complete [20]. The completion note is dated July 6, seventy-five days after the last observed activity [18].
Two hops matter here. Someone else's compromise supplied the initial access [3]. Checkmarx's own distribution channels supplied the next one [4]. A cybercriminal group then published repository data to the dark web [5], which is a third consequence with its own timeline. If you consume build-time artifacts from a security vendor, your dependency graph contains that vendor's dependency graph, and its detection latency becomes yours too.
