"We are aware that a modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace," Checkmarx told customers on May 9, 2026, as its engineers worked to remove a malicious build of the very plugin intended to secure continuous-integration pipelines.
Checkmarx response and the affected plugin release
Checkmarx notified customers on Saturday, May 9, that a modified version of its AST Scanner plugin for Jenkins had been made available via the Jenkins Marketplace and that "versions published as of May 9, 2026, should not be trusted." The company said it was "in the process of publishing a new version of this plug‑in" and urged users to confirm they are running the correct release: 2.0.13-829.vc72453fa_1c16, which was published on December 17, 2025.
How the compromised plugin appeared and was discovered
Security engineer Adnan Khan spotted the compromise quickly over the weekend, according to reporting. At the time of writing the backdoored plugin remained available on the Jenkins Marketplace and was installed by several hundred controllers, appearing as the most recently available version. Pull requests actioned on Monday morning, however, suggested the malicious listing would soon be pulled down.
TeamPCP’s repeated access to Checkmarx packages
The intrusion is the third time TeamPCP has compromised Checkmarx packages in as many months. In an earlier supply‑chain attack in April, TeamPCP defaced Checkmarx’s GitHub and published six packages whose descriptions alluded to "Shai‑Hulud" wormable malware; those packages no longer appear on Checkmarx’s GitHub. In March, TeamPCP successfully targeted Checkmarx’s AST plugin for GitHub Actions and its KICS static analysis tool and deployed credential‑stealing malware, reporting at least three successful compromises of Checkmarx assets across the recent period.
SOCRadar on the danger to CI/CD pipelines
SOCRadar framed the incident around how trust is granted inside build infrastructures: "What makes this particularly dangerous for Jenkins users is the trust model at play," it said. Because teams install the Checkmarx Jenkins plugin to improve pipeline security, a backdoored version "doesn’t just compromise one project; it rides trusted infrastructure into every build pipeline it touches, with access to source code, environment variables, tokens, and whatever secrets the runner can see."
What this means for technologists, procurement leaders, and TeamPCP
- Technologists and security teams: Checkmarx explicitly advised that versions available as of May 9 should not be trusted and named a specific safe release (2.0.13-829.vc72453fa_1c16, published December 17, 2025). Teams running the plugin will be watching for the new Checkmarx update and for the marketplace removal action noted by pull requests on Monday.
- Procurement leaders and affected enterprises: This is the third successful compromise of Checkmarx packages in as many months, following the March credential‑stealing incidents and the April GitHub defacement and package publications. Those facts underline a repeated supplier‑side disruption that procurement and risk managers will need to account for when evaluating the vendor's supply‑chain resilience.
- TeamPCP and other observers: SOCRadar suggested two possibilities to explain recurring access — that TeamPCP’s claim about Checkmarx’s secrets rotation was accurate, or that TeamPCP exploited an additional persistence mechanism Checkmarx did not detect during its response to the March intrusion. Observers will be looking for evidence that either secrets were exposed or that persistence mechanisms remain.
The immediate technical fact is narrow and concrete: Checkmarx has told customers not to trust plugin versions published as of May 9 and has identified a specific prior release as the one to verify. Beyond that, the incident sharpens a practical question left on the record by SOCRadar and repeated intrusions — whether TeamPCP’s gains reflect stale secrets, undetected persistence, or both — and offers a clear next step for defenders: confirm versions, monitor the marketplace removal, and await Checkmarx's replacement release.
