#7
The Hacker News
general
May 11, 2026 at 18:30 UTC
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
By [email protected] (The Hacker News)
AI Summary
A group called TeamPCP compromised the official Checkmarx Jenkins AST plugin on the Jenkins Marketplace, publishing a trojanized version containing an infostealer — the second supply chain incident linked to Checkmarx tooling following a prior KICS attack. Checkmarx confirmed users must roll back to version 2.0.13-829.vc72453fa_1c16 (published December 17, 2025) or earlier. Any CI/CD pipeline using the Checkmarx Jenkins plugin after that date should be treated as potentially compromised and investigated immediately.
Relevance score: 82.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →