Checkmarx Jenkins AST Plugin Supply Chain Compromise — TeamPCP Backdoored Plugin on Jenkins Marketplace
Checkmarx Jenkins AST Plugin Supply Chain Compromise (TL-2026-0492), also tracked as TeamPCP Jenkins Plugin Backdoor, is a high-severity supply-chain compromise scored CVSS 8.6, first published 2026-05-11. It is attributed to TeamPCP with high confidence, affects Checkmarx Checkmarx Jenkins AST Plugin, maps to 17 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0492
- Threat ID
- TL-2026-0492
- Also known as
- TeamPCP Jenkins Plugin Backdoor, Checkmarx AST Plugin Backdoor
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-11
- Last reviewed
- 2026-05-11
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, government, healthcare, defense, critical-infrastructure, software-development
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Checkmarx Jenkins AST Plugin Supply Chain Compromise
Malware and tooling: Custom TeamPCP HTTPS exfiltration channel (POST JSON to *.checkmarx.cx / checkmarx.zone)
Checkmarx disclosed on May 9, 2026 that a modified ('backdoored') version of the Checkmarx Jenkins AST Plugin was distributed via the official Jenkins Marketplace as part of the broader TeamPCP supply chain campaign. The trojanized release targets CI/CD secret exfiltration from Jenkins build agents running Checkmarx AST scans. Customers must verify they are pinned to the safe pre-compromise version 2.0.13-829.vc72453fa_1c16 (published 2025-12-17). The same actor previously trojanized Checkmarx GitHub Actions (ast-github-action, kics-github-action), KICS Docker images and OpenVSX VS Code extensions (ast-results, cx-dev-assist).
How Checkmarx Jenkins AST Plugin Supply Chain Compromise works
On May 9, 2026 Checkmarx published an update to its 'Ongoing Checkmarx Supply Chain Security Incident' blog warning customers that the Checkmarx Jenkins AST Plugin distributed through the Jenkins Marketplace had been compromised by the same threat cluster — tracked publicly as TeamPCP — that previously trojanized multiple pieces of Checkmarx's developer-tooling estate. The vendor advisory instructs all Jenkins administrators to immediately verify that they are running ONLY the pre-compromise version 2.0.13-829.vc72453fa_1c16 published on 2025-12-17, and to remove or roll back any later release of the plugin until a clean rebuild is published.
The Jenkins AST Plugin integrates Checkmarx Static Application Security Testing into Jenkins CI/CD pipelines. Jenkins agents that execute the plugin typically have access to highly privileged credentials: the Checkmarx tenant API token, source code checkouts, build secrets, container-registry credentials and (in many environments) cloud provider credentials used by downstream pipeline stages. A compromised plugin running on the agent therefore has a near-perfect vantage point for credential harvesting, source code exfiltration and lateral movement into the customer's CI/CD control plane.
The attack pattern observed across the broader TeamPCP campaign is consistent: trojanized releases of legitimate developer-tooling artefacts are pushed to official distribution channels (npm, PyPI, GitHub Actions Marketplace, OpenVSX, Docker Hub, and now Jenkins Marketplace) using either compromised maintainer credentials or compromised vendor build/release infrastructure. The malicious payload typically enumerates the host process for environment variables and well-known credential files, then exfiltrates the data over HTTPS to attacker-controlled infrastructure that impersonates Checkmarx-related domains (checkmarx.zone, checkmarx.cx, audit.checkmarx.cx, updates.checkmarx.cx). Several IP addresses (91.195.240.123, 94.154.172.43, 94.154.172.183) have been linked to TeamPCP infrastructure across earlier compromises.
This Jenkins-plugin compromise is significant because Jenkins remains one of the most widely deployed self-hosted CI/CD orchestrators in regulated industries (financial services, healthcare, critical infrastructure, defense). The Jenkins Marketplace does not enforce strict provenance/SLSA controls equivalent to public registries' newer attestation requirements, which means that downstream operators implicitly trust the named publisher. A malicious release published under the legitimate Checkmarx publisher account would be auto-suggested for upgrade to administrators who have enabled automatic plugin updates — a default configuration in many Jenkins installations.
The Threadlinqs assessment is that exposure is broad and severity is HIGH (with a credible path to CRITICAL impact for organizations whose Jenkins controllers hold cross-environment cloud credentials). Defenders should: (1) pin the plugin to 2.0.13-829.vc72453fa_1c16, (2) rotate any Checkmarx API tokens, source-control PATs, container-registry credentials and cloud credentials accessible from any Jenkins agent that ran a post-2025-12-17 plugin build, (3) hunt for outbound traffic to the known TeamPCP domains/IPs from Jenkins controllers and agents, (4) audit Jenkins plugin update history for the AST Plugin, and (5) treat any Jenkins instance that auto-updated the AST Plugin between 2025-12-17 and 2026-05-09 as a presumed-compromise host pending forensic clearance.
MITRE ATT&CK techniques used in TL-2026-0492
Collection
Defense Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Credential Access
defense-impairment
Persistence
T1554 Compromise Host Software Binary
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities
Affected products and versions in Checkmarx Jenkins AST Plugin Supply Chain Compromise
- Checkmarx — Checkmarx Jenkins AST Plugin
Vulnerable versions: any release after 2.0.13-829.vc72453fa_1c16 (post 2025-12-17) prior to a Checkmarx-issued clean rebuild
Fixed in: 2.0.13-829.vc72453fa_1c16 (2025-12-17, pre-compromise) — pin to this version - Jenkins — Jenkins (any controller running the affected plugin)
Vulnerable versions: all Jenkins versions when the affected plugin is installed
Remediation for Checkmarx Jenkins AST Plugin Supply Chain Compromise
Patches
- Verified-safe: Checkmarx Jenkins AST Plugin 2.0.13-829.vc72453fa_1c16 (published 2025-12-17). Any later release prior to a future Checkmarx-issued clean rebuild must be considered untrusted.
Immediate actions
- Pin the Checkmarx Jenkins AST Plugin to version 2.0.13-829.vc72453fa_1c16 (published 2025-12-17) on every Jenkins controller
- Remove any newer version of the plugin until Checkmarx publishes a verified clean rebuild
- Disable Jenkins automatic plugin updates organization-wide until a clean release is confirmed
- Rotate all Checkmarx AST tenant API tokens used by Jenkins integrations
- Rotate source-control PATs, container-registry credentials and cloud credentials reachable from any Jenkins agent that ran a post-2025-12-17 plugin build
- Block outbound traffic from Jenkins controllers and agents to checkmarx.zone, checkmarx.cx, audit.checkmarx.cx, updates.checkmarx.cx and the known TeamPCP IPs at the perimeter and egress proxy
Workarounds
- If unable to roll back, isolate Jenkins agents that run the AST Plugin into a network segment with no outbound internet access except to the Checkmarx tenant URL
- Disable the Checkmarx scan stage in Jenkinsfiles temporarily and run scans out-of-band from a hardened, ephemeral runner
Longer-term hardening
- Adopt explicit plugin allowlisting and signed-plugin enforcement on all Jenkins controllers
- Move secrets out of Jenkins agents into short-lived OIDC/workload-identity tokens scoped per pipeline run
- Enforce egress allowlisting from CI/CD agents — only known scanner endpoints and registry endpoints
- Subscribe to vendor PSIRT feeds for every CI/CD plugin in use and gate plugin upgrades through a staging Jenkins controller
- Require SLSA-style provenance/attestations for all CI/CD plugins consumed from public marketplaces
Weaknesses (CWE) in Checkmarx Jenkins AST Plugin Supply Chain Compromise
CWE-506, CWE-494, CWE-829, CWE-1357
Timeline of Checkmarx Jenkins AST Plugin Supply Chain Compromise
- Checkmarx publishes Jenkins AST Plugin version 2.0.13-829.vc72453fa_1c16 — the last known-clean release prior to the TeamPCP compromise.
- Checkmarx publishes initial 'Checkmarx Security Update' blog disclosing TeamPCP compromise of Checkmarx GitHub Actions (ast-github-action, kics-github-action), KICS Docker images and OpenVSX VS Code extensions (ast-results, cx-dev-assist).
- TeamPCP/Vect partnership observed expanding the operator network behind the campaign (tracked as TL-2026-0288).
- TeamPCP credential-harvester pattern observed in Xinference PyPI releases v2.6.0–2.6.2 (TL-2026-0438), confirming continued multi-ecosystem activity.
- Checkmarx updates the 'Ongoing Checkmarx Supply Chain Security Incident' advisory to disclose that the Jenkins AST Plugin on the Jenkins Marketplace was also compromised; instructs customers to pin to 2.0.13-829.vc72453fa_1c16.
- Threadlinqs Intelligence Platform opens TL-2026-0492 and triggers the multi-agent pipeline for research, simulation, detection authoring and correlation.
- SOCRadar publishes independent reporting confirming the Jenkins Marketplace compromise and tying it to prior TeamPCP infrastructure (checkmarx.zone, checkmarx.cx, audit/updates.checkmarx.cx).
- As of 2026-05-29, the malicious plugin (v2026.5.09, CVE-2026-33634) was live only May 9-10 2026 and Checkmarx shipped clean rebuilds (2.0.13-848/847), with the May 22 probe in "final stages." But TeamPCP retained a foothold, kept compromising tooling through May 17 (npm/PyPI worm), and faces no takedown—so the actor and reinfection risk persist.
Sources cited for Checkmarx Jenkins AST Plugin Supply Chain Compromise
- Update: Ongoing Checkmarx Supply Chain Security Incident
- SOCRadar — Checkmarx Jenkins Plugin Backdoored in New TeamPCP Supply Chain Attack
- Checkmarx Security Update: March 23
- Jenkins Plugins Site — Checkmarx AST
- Threadlinqs — Checkmarx KICS GitHub Action Compromise (TL-2026-0274)
- Threadlinqs — TeamPCP/Vect Partnership (TL-2026-0288)
- Threadlinqs — Xinference TeamPCP Compromise (TL-2026-0438)
- MITRE ATT&CK — T1195.002 Compromise Software Supply Chain
Threats related to Checkmarx Jenkins AST Plugin Supply Chain Compromise
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli v2026.4.0) — Shai-Hulud: The Third Coming / TeamPCP
- Checkmarx KICS GitHub Action Supply Chain Compromise by TeamPCP (kics-github-action Tag Hijacking)
- Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover
- TeamPCP Cascading Supply Chain Campaign: Telnyx PyPI Compromise with WAV Steganography
Detection coverage for TL-2026-0492
As of 2026-05-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0492 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.