# Checkmarx Jenkins AST Plugin Supply Chain Compromise — TeamPCP Backdoored Plugin on Jenkins Marketplace

> Checkmarx disclosed on May 9, 2026 that a modified ('backdoored') version of the Checkmarx Jenkins AST Plugin was distributed via the official Jenkins Marketplace as part of the broader TeamPCP supply chain campaign. The trojanized release targets CI/CD secret exfiltration from Jenkins build agents running Checkmarx AST scans. Customers must verify they are pinned to the safe pre-compromise version 2.0.13-829.vc72453fa_1c16 (published 2025-12-17). The same actor previously trojanized Checkmarx GitHub Actions (ast-github-action, kics-github-action), KICS Docker images and OpenVSX VS Code extensions (ast-results, cx-dev-assist).

- **Published:** 2026-05-11T12:00:00Z
- **Last reviewed:** 2026-05-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0492
- **ID:** TL-2026-0492
- **Severity:** HIGH (CVSS 8.6)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 9, 2026 Checkmarx published an update to its 'Ongoing Checkmarx Supply Chain Security Incident' blog warning customers that the Checkmarx Jenkins AST Plugin distributed through the Jenkins Marketplace had been compromised by the same threat cluster — tracked publicly as TeamPCP — that previously trojanized multiple pieces of Checkmarx's developer-tooling estate. The vendor advisory instructs all Jenkins administrators to immediately verify that they are running ONLY the pre-compromise version 2.0.13-829.vc72453fa_1c16 published on 2025-12-17, and to remove or roll back any later release of the plugin until a clean rebuild is published.

The Jenkins AST Plugin integrates Checkmarx Static Application Security Testing into Jenkins CI/CD pipelines. Jenkins agents that execute the plugin typically have access to highly privileged credentials: the Checkmarx tenant API token, source code checkouts, build secrets, container-registry credentials and (in many environments) cloud provider credentials used by downstream pipeline stages. A compromised plugin running on the agent therefore has a near-perfect vantage point for credential harvesting, source code exfiltration and lateral movement into the customer's CI/CD control plane.

The attack pattern observed across the broader TeamPCP campaign is consistent: trojanized releases of legitimate developer-tooling artefacts are pushed to official distribution channels (npm, PyPI, GitHub Actions Marketplace, OpenVSX, Docker Hub, and now Jenkins Marketplace) using either compromised maintainer credentials or compromised vendor build/release infrastructure. The malicious payload typically enumerates the host process for environment variables and well-known credential files, then exfiltrates the data over HTTPS to attacker-controlled infrastructure that impersonates Checkmarx-related domains (checkmarx.zone, checkmarx.cx, audit.checkmarx.cx, updates.checkmarx.cx). Several IP addresses (91.195.240.123, 94.154.172.43, 94.154.172.183) have been linked to TeamPCP infrastructure across earlier compromises.

This Jenkins-plugin compromise is significant because Jenkins remains one of the most widely deployed self-hosted CI/CD orchestrators in regulated industries (financial services, healthcare, critical infrastructure, defense). The Jenkins Marketplace does not enforce strict provenance/SLSA controls equivalent to public registries' newer attestation requirements, which means that downstream operators implicitly trust the named publisher. A malicious release published under the legitimate Checkmarx publisher account would be auto-suggested for upgrade to administrators who have enabled automatic plugin updates — a default configuration in many Jenkins installations.

The Threadlinqs assessment is that exposure is broad and severity is HIGH (with a credible path to CRITICAL impact for organizations whose Jenkins controllers hold cross-environment cloud credentials). Defenders should: (1) pin the plugin to 2.0.13-829.vc72453fa_1c16, (2) rotate any Checkmarx API tokens, source-control PATs, container-registry credentials and cloud credentials accessible from any Jenkins agent that ran a post-2025-12-17 plugin build, (3) hunt for outbound traffic to the known TeamPCP domains/IPs from Jenkins controllers and agents, (4) audit Jenkins plugin update history for the AST Plugin, and (5) treat any Jenkins instance that auto-updated the AST Plugin between 2025-12-17 and 2026-05-09 as a presumed-compromise host pending forensic clearance.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Update: Ongoing Checkmarx Supply Chain Security Incident](https://checkmarx.com/blog/ongoing-security-updates/)
- [SOCRadar — Checkmarx Jenkins Plugin Backdoored in New TeamPCP Supply Chain Attack](https://socradar.io/blog/checkmarx-jenkins-plugin-teampcp-backdoor/)
- [Checkmarx Security Update: March 23](https://checkmarx.com/blog/checkmarx-security-update/)
- [Jenkins Plugins Site — Checkmarx AST](https://plugins.jenkins.io/checkmarx-ast-scanner/)
- [Threadlinqs — Checkmarx KICS GitHub Action Compromise (TL-2026-0274)](https://intel.threadlinqs.com/threat/TL-2026-0274)
- [Threadlinqs — TeamPCP/Vect Partnership (TL-2026-0288)](https://intel.threadlinqs.com/threat/TL-2026-0288)
- [Threadlinqs — Xinference TeamPCP Compromise (TL-2026-0438)](https://intel.threadlinqs.com/threat/TL-2026-0438)
- [MITRE ATT&CK — T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0492