Checkmarx Jenkins AST plugin backdoored by TeamPCP - third Checkmarx supply chain hit since late March

TeamPCP, the group behind the March Trivy breach and Shai-Hulud npm worm, used credentials stolen in that March attack to publish a backdoored version of Checkmarx's Jenkins AST plugin to the Jenkins Marketplace. This is the third Checkmarx supply-chain hit since late March. The rogue version 2026.5.09 went up on May 9, outside Checkmarx's normal release process - no git tag, no GitHub release. Checkmarx says its GitHub repos are isolated from customer production and no customer data is stored there, but anyone who installed the bad plugin should assume their CI credentials are compromised, rotate them all, and hunt for lateral movement.

Check

Check whether your Jenkins instances have the Checkmarx AST plugin installed. If yes, verify the running version - anything dated 2026.5.09 in the version string is the malicious build.

Affected

Any Jenkins instance running the rogue Checkmarx Jenkins AST plugin version 2026.5.09, which was published to the Jenkins Marketplace on May 9, 2026, between then and Checkmarx's takedown. The plugin was outside Checkmarx's normal release pipeline and lacked both a git tag and a GitHub release.

Fix

Roll back to version 2.0.13-829.vc72453fa_1c16 published December 17, 2025, or any earlier officially-tagged build. Rotate every credential the Jenkins host had access to, including cloud API keys, source-repo tokens, deployment keys, and signing certificates. Hunt for lateral movement from the Jenkins host. Pull Checkmarx's published IoC list from their Support Portal and run it across your environment.