TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
A modified version of the Jenkins AST plugin has been released to the Jenkins Marketplace, according to Checkmarx.
The cybersecurity firm said in a statement over the weekend that if you are using the Checkmarx Jenkins AST plugin, you must make sure you are using version 2.0.13-829.vc72453fa_1c16, which was released on December 17, 2025, or earlier.
Checkmarx has published 2.0.13-848.v76e89de8a_053 on GitHub and the Jenkins Marketplace as of this writing, but their incident update still states that a new version of this plugin is being released. How the malicious plugin version was released was not disclosed.
This is the most recent attack on Checkmarx that TeamPCP has planned. It comes a few weeks after the infamous cybercrime group was linked to the hack of two VS Code extensio...