TLDR Tech / InfoSec
Official CheckMarx Jenkins package compromised with infostealer
TeamPCP, the same group behind the Shai-Hulud npm campaigns and the Trivy scanner breach, pushed a rogue version (2026.5.09) of Checkmarx's Jenkins AST plugin to the Jenkins Marketplace on May 9. They pivoted in via credentials stolen during their March compromise of Trivy, which Checkmarx never rotated. The malicious build sat outside the plugin's release pipeline, lacked a Git tag and GitHub release, and broke the project's date-based versioning scheme. Users should roll back to 2.0.13-829.vc72453fa_1c16 (December 17, 2025) or earlier, rotate every secret that touched a Jenkins runner executing the plugin, and hunt for lateral movement and persistence. Defenders should treat any vendor breach involving stolen repository credentials as a standing supply-chain risk until rotation is confirmed, and pull Checkmarx's published IOCs into CI/CD telemetry.
Read the full story