Checkmarx Jenkins AST Plugin Backdoored for 31 Hours as TeamPCP Returns Weeks After the KICS Compromise
A malicious build of Checkmarx's Jenkins AST plugin was live on the Jenkins Marketplace from May 9 at 01:25 UTC to May 10 at 08:47 UTC, the latest TeamPCP intrusion against Checkmarx weeks after the April KICS wave.
Overview
A modified version of Checkmarx’s Jenkins Application Security Testing (AST) plugin was published to the Jenkins Marketplace and remained installable for roughly 31 hours over the weekend before the vendor pulled it, according to The Hacker News. Checkmarx confirmed the compromise in a public advisory and urged customers to roll back to the last known-clean release published in December 2025, as reported by The Register. The intrusion has been attributed to TeamPCP, the same cybercrime crew tied to the late-March Trivy breach and the April compromise of Checkmarx’s KICS Docker image, VS Code extensions, and GitHub Actions workflow.
What We Know
The trojanized plugin, tagged 2026.5.09, was available from May 9, 2026 at 01:25 UTC through May 10, 2026 at 08:47 UTC, per Checkmarx’s incident update page. Checkmarx told customers in its advisory, “If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously.” The company subsequently published two clean releases on May 9, 2026 — 2.0.13-848.v76e89de8a_053 and 2.0.13-847.v08c0072b_2fd5 — according to its own update.
In a statement to multiple outlets, Checkmarx said, “We are aware that a modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace,” adding that it was “in the process of publishing a new version of this plug-in,” as quoted by The Register. The vendor’s guidance is unambiguous: “Versions published as of May 9, 2026, should not be trusted,” The Register reported.
Attackers also defaced the plugin’s source repository. According to The Hacker News, the page was renamed to “Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now,” and the description was changed to read, “Checkmarx fails to rotate secrets again. with love – TeamPCP.” BleepingComputer reported the same defacement message and tied the May intrusion to access that originally flowed from the late-March compromise of Trivy. Checkmarx’s broader statement to BleepingComputer noted that, “As a result of that access, the attackers were able to interact with Checkmarx’s GitHub environment and subsequently publish malicious code to certain artifacts,” BleepingComputer reported.
On impact, Checkmarx’s remediation guidance is to rotate every credential the Jenkins runner could see — “GitHub tokens, cloud credentials (AWS/GCP/Azure), Kubernetes configurations, Docker credentials, and SSH keys,” according to Techzine. Threat-intelligence firm SOCRadar, cited by The Register, said the danger lies in Jenkins’ trust model: “What makes this particularly dangerous for Jenkins users is the trust model at play,” SOCRadar wrote, adding that “a backdoored version doesn’t just compromise one project; it rides trusted infrastructure into every build pipeline it touches, with access to source code, environment variables, tokens, and whatever secrets the runner can see.”
The TeamPCP Pattern
The Jenkins compromise extends a TeamPCP campaign against Checkmarx that has been visible since March. The Hacker News framed it as the “latest attack orchestrated by TeamPCP targeting Checkmarx,” arriving “a couple of weeks after the notorious cybercrime group was attributed to the compromise of its KICS Docker image, two VS Code extensions, and a GitHub Actions workflow.” That April wave was the same supply-chain incident that downstream produced the brief Bitwarden CLI npm package compromise that The Machine Herald previously reported, with The Hacker News describing the downstream payload as “a similar stealer that can harvest a wide range of developer secrets.”
The attackers’ choice of target also fits the broader 2026 pattern in which security tooling itself has become the entry point into developer pipelines, including the PyTorch Lightning PyPI compromise earlier this month. Techzine reported that the malicious Jenkins plugin carried branding consistent with the wider campaign — repository names such as kralizec-navigator-709 and descriptions including the phrase “A Mini Shai-Hulud has Appeared” — the same Dune-themed signature that has accompanied earlier TeamPCP intrusions.
SOCRadar, in commentary quoted by The Hacker News, framed the recurrence as a sign of incomplete remediation: “A second Checkmarx incident happening this soon suggests the group is actively watching for re-entry points, testing the depth of past remediations, and capitalizing on any gaps.” Techzine noted the scale of the wider campaign that began in March, reporting that “[i]n March 2026, the group had already compromised checkmarx/ast-github-action and checkmarx/kics-github-action,” and that during the same campaign “more than 66 npm packages were compromised, and at least 1,000 enterprise SaaS environments were potentially exposed.”
What We Don’t Know
None of the cited reporting puts a number on how many organizations pulled the malicious 2026.5.09 build during the 31-hour exposure window, and Checkmarx has not publicly disclosed download or victim counts. SecurityWeek’s writeup similarly does not attempt a quantitative estimate. Detailed reverse-engineering of the trojanized plugin’s payload — including the precise command-and-control endpoints and on-host behavior — has also not been published in the sources surveyed for this report. The attribution to TeamPCP rests on the defacement signature and the operational continuity with March and April activity rather than on a formal vendor-led incident report.
Why It Matters
A static application-security testing plugin is, by design, a privileged actor inside a build pipeline: it sees source code, environment variables, secrets, and the tokens needed to interact with whatever code-hosting and cloud services the build touches. A backdoored AST plugin that runs alongside or in place of the legitimate one is therefore worse than a typical compromised dependency; it directly inverts the security premise the plugin is sold against. Checkmarx’s own remediation list — rotate GitHub tokens, AWS/GCP/Azure credentials, Kubernetes configurations, Docker credentials, and SSH keys — illustrates the breadth of secrets a Jenkins runner can legitimately hold and, after the May 9 incident, the breadth of what TeamPCP-affiliated tooling has had access to harvest.