Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack
Checkmarx Jenkins AST plugin compromised with malicious version published to Jenkins Marketplace.
Summary
Checkmarx warned users that a malicious version of its Jenkins AST plugin was published to the Jenkins Marketplace as part of an ongoing supply chain attack. The company released patched versions (2.0.13-848.v76e89de8a_053) on GitHub and the Jenkins Marketplace over the weekend. This incident is linked to a broader supply chain compromise affecting Checkmarx since March 2025, involving the TeamPCP hacker gang and subsequent data theft by Lapsus$.
Full text
Checkmarx on Friday warned users that a malicious version of its Jenkins AST plugin was published as part of a supply chain attack. The plugin enables users to integrate the functionality of the Checkmarx One platform into Jenkins pipelines, allowing them to scan source code using the Checkmarx AST platform. “We are aware that a modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace. We are in the process of publishing a new version of this plugin,” Checkmarx said on Friday. The company told users to ensure they are running version 2.0.13-829.vc72453fa_1c16 of the Jenkins AST plugin, which was published in December 2025. Over the weekend, Checkmarx released two new versions of the plugin. The latest iteration, 2.0.13-848.v76e89de8a_053, is now available on both GitHub and the Jenkins Marketplace. Checkmarx has not shared information on how the malicious plugin version was published, but the incident is part of the supply chain attack the security firm has been dealing with since March.Advertisement. Scroll to continue reading. As a result of the Trivy supply chain attack, the TeamPCP hacker gang accessed Checkmarx’s repositories in late March and published malicious artifacts. A month later, likely due to continuous or renewed attacker access, a new wave of malicious artifacts was published on behalf of Checkmarx. Soon after, the infamous Lapsus$ extortion group publicly released data allegedly stolen from the company’s repositories. The company confirmed at the time that the data was likely stolen from its GitHub repositories in late March, using credentials compromised through the Trivy supply chain attack. Related: Vendor Says Daemon Tools Supply Chain Attack Contained Related: AI Coding Agents Could Fuel Next Supply Chain Crisis Related: Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack Related: 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire GitHub Confirms Hack Impacting 3,800 Internal RepositoriesVerizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach VectorUnpatched ChromaDB Vulnerability Can Lead to Server TakeoverB1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards201 Arrested in Crackdown on Cybercrime in Middle East, North AfricaPoC Released for DirtyDecrypt Linux Kernel Vulnerability‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor DeliveryResearcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE Latest News Quantum Bridge Raises $8 Million for Quantum-Safe Key Distribution SolutionMicrosoft Rolls Out Mitigations for ‘YellowKey’ BitLocker BypassAI-Powered App Attacks Are Faster, More Frequent and Harder to Stop1Password Teams With OpenAI to Stop AI Coding Agents From Leaking CredentialsAnthropic Silently Patches Claude Code Sandbox BypassOver 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackCaught Off Guard: Securing AI After It Hits ProductionReal-World ICS Security Tales From the Trenches Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register Webinar: Third-Party Risk in Practice June 4, 2026 Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice. Register People on the MoveTim Byrd has been appointed Chief Information Security Officer at First Citizens Bank.IRONSCALES has named Steve McKenzie as Chief Operating Officer.Silvio Pappalardo has joined AuthMind as Chief Revenue Officer.More People On The MoveExpert Insights Caught Off Guard: Securing AI After It Hits Production As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb) Cyber Resilience is the New Business Continuity Plan The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin) Enhancing Data Center Security Without Sacrificing Performance For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael) Is the SOC Obsolete, and We Just Haven’t Admitted It Yet? Many AI-first enterprises have already embraced sovereign architectures for general AI initiatives; cybersecurity—and the SOC—should be next. (Danelle Au) The Mythos Moment: Enterprises Must Fight Agents with Agents Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email