TeamPCP Compromised Checkmarx Jenkins AST Plugin Following KICS Supply Chain Attack

A supply chain attack that started with a relatively obscure open-source scanner has now reached one of the most widely used application security tools in the industry. In May 2026, a malicious version of the Checkmarx Jenkins AST plugin was quietly published to the Jenkins Marketplace, exposing development pipelines to credential theft and unauthorized access.

The incident traces back to a threat actor known as TeamPCP, whose earlier attack on the Trivy scanner set off a chain reaction with far wider consequences than many initially expected.

The attack did not happen in a single moment. It unfolded over weeks, beginning on March 23, 2026, when attackers first pushed malicious code directly into Checkmarx’s GitHub repository. That initial breach was linked to the TeamPCP supply chain compromise of the Trivy scanner, which the security community had flagged on March 19 as a potential tool for harvesting credentials from downstream users and their connected systems.

Analysts at Checkmarx traced the likely attack path back to the earlier Trivy incident, noting that the credentials obtained from that campaign were probably what allowed attackers to gain unauthorized access to the GitHub environment.

Once inside, the attackers interacted with internal repositories and pushed malicious code into key artifacts that are distributed to developers around the world.

The Jenkins Plugin Compromise

What followed was a multi-stage campaign with a growing blast radius. On April 22, 2026, a second wave of malicious artifacts was published, signaling that the attackers had maintained or regained access even after initial containment efforts. A cybercriminal group later identified as LAPSUS$ then published data stolen from Checkmarx’s GitHub repositories to the dark web on April 25, nearly a month after the suspected data exfiltration on March 30.

The full scope became clearer in May when a tampered version of the Jenkins AST plugin was uploaded to the Jenkins Marketplace under version 2026.5.09, giving the campaign a fresh and dangerous foothold across CI/CD pipelines worldwide.

The Jenkins plugin attack marked a significant escalation in an already serious incident. The malicious version, labeled 2026.5.09, was built to behave exactly like a legitimate tool, making it extremely difficult for development teams to detect the threat during routine pipeline runs. The window of exposure ran from May 9, 2026 at 01:25 UTC to May 10, 2026 at 08:47 UTC.

Any organization that pulled the plugin during that window and used it in an active build pipeline may have been exposed. Checkmarx confirmed that the last known safe version was 2.0.13-829.vc72453fa_1c16, published in December 2025. Teams running that version or any earlier release are not considered affected by this particular wave of the attack.

Checkmarx moved quickly to remove the malicious plugin and is working to publish a verified clean replacement. Organizations that rely on automated plugin updates are especially at risk, since the malicious version could have been pulled in silently without any visible change to the build configuration.

KICS and the Broader Artifact Exposure

The April wave hit a wider range of developer tools simultaneously. The public KICS Docker image on DockerHub was compromised between April 22, 2026 at 12:31 UTC and 12:59 UTC, while the ast-github-action was tampered with between 14:17 and 15:41 UTC the same day. The VS Code extensions for Checkmarx AST results and Developer Assist were also replaced with malicious versions across both the Microsoft and Open VSX marketplaces.

Based on the investigation, the primary purpose of the malicious code was the collection and attempted exfiltration of credentials and secrets from affected environments. Targeted data included GitHub personal access tokens, cloud credentials for AWS, Azure, and Google Cloud, Kubernetes service account tokens, SSH keys, and Docker registry credentials.

Checkmarx has recommended that organizations immediately block outbound access to checkmarx.cx and audit.checkmarx.cx. Teams should also rotate all potentially exposed credentials, pin tools to verified SHA hashes, disable auto-update settings on IDE extensions, and review CI/CD logs for any references to tpcp.tar.gz, checkmarx.zone, or unexpected repositories such as tpcp-docs.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File Name	checkmarx-ast-scanner-2026.5.09.hpi	Malicious Jenkins AST plugin file
SHA256	01ff1e56fd59a8fa525d97e670f7f297a1a204331b89b2cd4e36a9abc6419203	Hash of malicious .hpi plugin file
File Name	checkmarx-ast-scanner-2026.5.09.jar	Malicious Jenkins plugin JAR artifact
SHA256	f50a96d26a5b0beb29de4127e82b2bf350c21511e5a43d286e43f798dc6cd53f	Hash of malicious .jar plugin file
File Name	checkmarx-ast-scanner-2026.5.09.pom	Malicious Jenkins plugin POM file
SHA256	3ddb8967919a801b3c383e58cddceab21138134c6a26560d99e2672e86f36f2a	Hash of malicious .pom plugin file
Domain	checkmarx.cx	Attacker-controlled C2 domain
IP Address	91.195.240.123	Resolves to checkmarx.cx (attacker infrastructure)
Domain	audit.checkmarx.cx	Attacker-controlled subdomain
IP Address	94.154.172.43	Resolves to audit.checkmarx.cx
IP Address	94.154.172.183	Resolves to updates.checkmarx.cx
Domain	checkmarx.zone	Attacker-controlled domain used in March 23 wave
File Name	tpcp.tar.gz	Malicious archive artifact linked to TeamPCP
Repository	tpcp-docs	Unexpected/suspicious repository associated with TeamPCP activity
Docker Image Tag	checkmarx/kics:v2.1.20-debian	Malicious KICS Docker image tag
Docker Image Tag	checkmarx/kics:latest	Malicious KICS Docker image tag
SHA256	222e6bfed0f3b…	Malicious KICS Docker image SHA (partial, see full advisory)
VSIX File	ast-results-2.53.0.vsix	Malicious VS Code extension from OpenVSX (March wave)
VSIX File	cx-dev-assist-1.7.0.vsix	Malicious VS Code extension from OpenVSX (March wave)
GitHub Action Tag	checkmarx/ast-github-action:2.3.35	Malicious GitHub Action tag (April wave)
VS Code Extension Version	checkmarx.ast-results:2.63 / 2.66	Malicious AST Results extension versions
VS Code Extension Version	checkmarx.cx-dev-assist:1.17 / 1.19	Malicious Developer Assist extension versions

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post TeamPCP Compromised Checkmarx Jenkins AST Plugin Following KICS Supply Chain Attack appeared first on Cyber Security News.