Vendor Breach Disclosure Practice

Attackers rode the Trivy compromise into Checkmarx's GitHub and out through its VS Code extensions

Mandiant's findings say the intrusion never reached Checkmarx One or production AWS, and that answers the vendor's question rather than the one a customer has about what a build box pulled in late March.