Official Checkmarx Jenkins Plugin Compromised with Infostealer

A significant security incident has shaken the Jenkins community, as a compromised version of the official Checkmarx Application Security Testing (AST) plugin was discovered on the Jenkins Marketplace. The malicious plugin, identified as version 2026.5.09, was uploaded on May 9, 2026, and remained available for an undisclosed period, potentially affecting numerous Jenkins users who had automatic updates enabled. This supply chain attack has been attributed to the notorious TeamPCP hacker group, known for a series of similar breaches targeting various software components and platforms. The rogue plugin was designed to act as an infostealer, meaning it could compromise credentials and other sensitive information from the Jenkins build environment. The vulnerability has been assigned CVE-2026-33634 with a critical CVSS score of 9.4, underscoring the severity of the threat. The attack leveraged unauthorized access to Checkmarx's GitHub repositories, where TeamPCP reportedly backdoored the Jenkins AST plugin. This incident is part of a broader campaign by TeamPCP, which has been linked to other supply chain compromises, including the Shai-Hulud campaigns on npm and a breach involving the Trivy vulnerability scanner. Checkmarx has confirmed the compromise and advised users to ensure they are running version 2.0.13-829.vc72453fa_1c16 of the plugin, published on December 17, 2025, or an older, safe version. Any Jenkins instance that pulled the malicious 2026.5.09 update during the exposure window is at risk, and users are urged to assume their credentials are compromised, rotate all secrets, and investigate for any signs of lateral movement or persistence within their systems. The company has since released an updated version, 2.0.13-848.v76e89de8a_053, to address the incident. This event serves as a stark reminder of the critical importance of supply chain security in modern CI/CD pipelines. As Jenkins is a widely used open-source automation server, integrating with numerous tools and platforms through its extensive plugin ecosystem, the compromise of a single plugin can have far-reaching consequences. Organizations must implement rigorous security practices, including careful vetting of plugins, monitoring for suspicious activity, and maintaining robust credential hygiene, to protect their development and deployment workflows from such sophisticated attacks.