Signal
Checkmarx Jenkins plugin compromised with infostealer in supply chain attack
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-05-11 18:30 UTCUpdated 2026-05-11 22:03 UTC
rss
cveexploitsmalwarethreat_actorssecurity_toolingincident_response
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Checkmarx confirmed that a rogue version of its Jenkins Application Security Testing (AST) plugin was published on the Jenkins Marketplace. The compromised plugin, linked to the threat actor TeamPCP, contains an infostealer.
Entities
CheckmarxJenkins Application Security Testing (AST) pluginKICS
Score total
1.01
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- The compromised plugin was recently published on the Jenkins Marketplace.
- Checkmarx issued warnings over the weekend to alert users.
- This follows a recent supply chain attack involving another Checkmarx product, KICS.
Why it matters
- Supply chain attacks on widely used developer tools can lead to widespread compromise.
- Users relying on compromised plugins risk data theft via infostealers.
- Prompt patching and version verification are critical to mitigate such threats.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- A rogue version of the Checkmarx Jenkins AST plugin containing an infostealer was published on the Jenkins Marketplace.
- Users should ensure they use version 2.0.13-829.vc72453fa_1c16 or earlier of the Checkmarx Jenkins AST plugin to avoid compromise.
How sources frame it
- BleepingComputer: neutral
- The Hacker News: neutral
This incident highlights the persistent risk of supply chain compromises in developer tooling ecosystems and the need for vigilance in plugin version management.
All evidence
All evidence
Official CheckMarx Jenkins package compromised with infostealer
bleepingcomputer_all · bleepingcomputer.com · 2026-05-11 22:03 UTC
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
thehackernews · thehackernews.com · 2026-05-11 18:30 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- bleepingcomputer_all (1)
- thehackernews (1)
Top origin domains (this list)
- bleepingcomputer.com (1)
- thehackernews.com (1)