# Checkmarx Hit Again: TeamPCP Compromises Jenkins Plugin Weeks After Supply Chain Blitz
Security firm faces second major breach in as many months, raising critical questions about remediation practices and persistent threat actor access.
Checkmarx disclosed over the weekend that a malicious version of its Jenkins AST plugin was published to the official Jenkins Marketplace, marking the second significant supply chain compromise targeting the security vendor in mere weeks. The incident represents an escalation in what security researchers are calling an alarmingly persistent campaign by the cybercriminal group TeamPCP to infiltrate and weaponize trusted development tools.
## The Immediate Threat
Checkmarx confirmed that an unauthorized plugin version bearing build number 2.0.13-829.vc72453fa_1c16, published on December 17, 2025, was compromised. Users currently running this version or older iterations are urged to immediately upgrade to the patched release 2.0.13-848.v76e89de8a_053, now available on both GitHub and the Jenkins Marketplace.
The company issued a terse statement: "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using version 2.0.13-829.vc72453fa_1c16 that was published on December 17, 2025 or previously." However, Checkmarx has not publicly disclosed the malicious payload, the attack vector, or the full scope of compromise.
## How the Attack Unfolded
According to details shared by security researcher Adnan Khan and threat intelligence firm SOCRadar, TeamPCP gained unauthorized access to the plugin's GitHub repository and performed a symbolic demonstration of their control. The repository was renamed to "Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now," and the description was updated with the taunting message: "Checkmarx fails to rotate secrets again. with love – TeamPCP."
This is not merely a technical breach—it's a public humiliation designed to undermine customer confidence and advertise the threat actor's capabilities to the broader development community.
## Context: A Pattern of Relentless Targeting
The Jenkins plugin compromise is the second major attack on Checkmarx in under six weeks, a timeline that raises uncomfortable questions about the security firm's incident response and credential management practices.
In March 2026, TeamPCP was attributed to a sweeping supply chain attack against Checkmarx that compromised multiple trusted distribution channels:
| Compromised Component | Details |
|---|---|
| KICS Docker Image | Malicious image published, potentially exposing thousands of users |
| VS Code Extensions | Two official Checkmarx extensions were weaponized |
| GitHub Actions Workflow | Hijacked to distribute credential-stealing malware |
| Bitwarden CLI npm Package | Briefly compromised to serve similar stealer malware |
The March attack was part of a broader campaign that exploited the inherent trust in the software supply chain, allowing TeamPCP to propagate information-stealing malware and harvest a wide range of developer secrets across numerous organizations.
## The Critical Question: Incomplete Remediation
What makes this May incident particularly troubling is the speed of recompromise. SOCRadar's analysis suggests two distressing possibilities:
1. Incomplete Credential Rotation: The March 2026 incident response may have failed to fully identify and revoke all compromised credentials, leaving doors open for lateral movement.
2. Persistent Foothold: TeamPCP may have deliberately retained undetected access through backdoors, supply chain implants, or subtle persistence mechanisms that survived the initial remediation sweep.
"The fact that TeamPCP is back inside Checkmarx systems just weeks later points to one of two possibilities: either the initial remediation was incomplete and credentials were not fully rotated, or the group retained a foothold that wasn't identified during the March response," SOCRadar stated. "A second Checkmarx incident happening this soon suggests the group is actively watching for re-entry points, testing the depth of past remediations, and capitalizing on any gaps."
## TeamPCP: A Sprawling Supply Chain Campaign
TeamPCP has emerged as one of the most sophisticated and audacious supply chain threat actors operating in 2026. The group's campaign, which began in March 2026, demonstrates systematic exploitation of developer trust and infrastructure visibility:
The repeated targeting of Checkmarx suggests that either the company remains an attractive target due to the widespread deployment of its tools, or TeamPCP has become deeply embedded in the company's infrastructure and development pipeline.
## Implications for Organizations
The cascading nature of these supply chain attacks carries profound implications:
For Checkmarx Customers: Organizations deploying the Jenkins AST plugin, KICS, or other Checkmarx tools should assume potential compromise and conduct thorough security audits. Any credentials or secrets that may have been exposed through these compromised tools should be rotated immediately.
For Enterprise Security Teams: This incident underscores the critical risk of trusting third-party security vendors and development tools. Even tools designed to *improve* security posture can become weaponized vectors if their supply chains are compromised.
For CI/CD Pipelines: Jenkins remains a high-value target due to its deep integration into development workflows and privileged access to build systems, source code repositories, and artifact storage. The compromise of a Jenkins plugin distributes malware directly into thousands of development environments.
For Industry-Wide Practice: The recompromise of Checkmarx in such a short timeframe demonstrates that many organizations lack the capability to detect persistent threat actor presence or the rigor to ensure complete credential rotation after incidents.
## Recommendations
Immediate Actions:
Broader Security Measures:
Detection and Response:
---
## HackWire Analysis
What makes this incident particularly significant is not merely the technical compromise, but what it reveals about the maturity gap between organization incident response and modern threat actor persistence tactics. TeamPCP's recompromise of Checkmarx in six weeks suggests the group understood something critical: the initial remediation likely focused on *discovered* access points while missing *planted* ones.
The public defacement of the repository—complete with mocking language about credential rotation failures—is strategically calculated. It's not just about malware distribution; it's about eroding trust in the supply chain itself. Every developer who sees that message now questions whether other tools they depend on might be compromised, whether their vendors are actually secure, and whether they should trust automated updates at all.
The pattern across TeamPCP's campaign reveals a shift in attacker sophistication. Rather than smash-and-grab credential theft, they're demonstrating the ability to maintain access, test remediation effectiveness, and re-exploit at will. This is the supply chain attack playbook of 2026: persistent, patient, and designed to survive initial incident response.
For organizations, this underscores a hard truth: your security posture is only as strong as the slowest vendor in your supply chain. Checkmarx is a security company—if they can be compromised twice in six weeks, traditional air-gapped incident response may not be sufficient. Organizations need to assume compromise of third-party tools and design defenses accordingly, with segmentation, secret rotation on strict schedules, and behavioral detection that assumes trusted tools may be weaponized.
— HackWire Editorial
---
## Related Coverage