Checkmarx Jenkins Plugin Compromised in Supply-Chain Attack
In a significant cybersecurity incident, Checkmarx has reported that a rogue version of its Jenkins Application Security Testing (AST) plugin was uploaded to the Jenkins Marketplace. The breach, attributed to the hacker group TeamPCP, is part of a series of supply-chain attacks that have raised alarms in the tech community.
The compromised plugin, which integrates security scanning into automated development processes, was modified to include credential-stealing malware. Users who downloaded the malicious version are urged to assume their credentials are compromised and to take immediate action by rotating all passwords.
While Checkmarx assures customers that their production environments remain secure, the incident highlights the risks of supply-chain vulnerabilities in software development. Users should verify they are using the legitimate plugin version published in December 2025.
Risk Level: High
To protect against such threats, maintain vigilance around software updates, and regularly audit third-party plugins for authenticity.
Source: View Original Report
