TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

"Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously," the cybersecurity company said in a statement over the weekend."

"As of writing, Checkmarx has released 2.0.13-848.v76e89de8a_053 on both GitHub and the Jenkins Marketplace, although its incident update still notes that it's "in the process of publishing a new version of this plugin." It did not disclose how the malicious plugin version was published."

"According to details shared by security researcher Adnan Khan and SOCRadar, TeamPCP is said to have gained unauthorized access to the plugin's GitHub repository and renamed it to "Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now." The defaced repository was also updated to include the description: "Checkmarx fails to rotate secrets again. with love - TeamPCP.""

""The fact that TeamPCP is back inside Checkmarx systems just weeks later points to one of two possibilities: either the initial remediation was incomplete and credentials were not fully rotated, or the group retained a foothold that wasn't identified""

A modified Jenkins AST plugin version was published to the Jenkins Marketplace. Checkmarx advised users of the Checkmarx Jenkins AST plugin to ensure they are using version 2.0.13-829.vc72453fa_1c16 published on December 17, 2025 or earlier. A newer version, 2.0.13-848.v76e89de8a_053, was released on GitHub and the Marketplace, while an incident update indicated a new plugin version was still being published. TeamPCP, a threat actor linked to multiple supply-chain compromises, was attributed to unauthorized access of the plugin’s GitHub repository and defacement with messages claiming Checkmarx failed to rotate secrets. The activity followed earlier compromises involving a KICS Docker image, VS Code extensions, and a GitHub Actions workflow, and it continued a campaign targeting software supply-chain trust.

Read at The Hacker News