TeamPCP Linked to Modified Checkmarx Jenkins AST Plugin Published to Marketplace
Summary
Checkmarx confirmed a modified Jenkins AST plugin was published to the Jenkins Marketplace. Researchers say TeamPCP gained unauthorized repository access; Checkmarx released a newer plugin version, but did not explain how the modified version was published.
Key points
- Checkmarx confirmed that a modified Jenkins AST plugin was published to the Jenkins Marketplace; it did not disclose how.
- Researchers Adnan Khan and SOCRadar said TeamPCP gained unauthorized access to the plugin’s GitHub repository.
- Checkmarx advised users to verify they were running version 2.0.13-829.vc72453fa_1c16 or earlier, and later released version 2.0.13-848.v76e89de8a_053.
- The incident follows reported compromises involving Checkmarx’s KICS Docker image, VS Code extensions and GitHub Actions workflow, as well as the Bitwarden CLI npm package.
- SOCRadar suggested the incident could indicate incomplete remediation or an actor foothold that was not identified; these possibilities were not established as fact.
Article Details
- Victim Organization
- Checkmarx
- Incident Type
- Software supply-chain compromise involving publication of a modified Checkmarx Jenkins AST plugin to the Jenkins Marketplace and reported unauthorized access to the plugin's GitHub repository.
- Operational Impact
- Checkmarx confirmed that a modified plugin version was published and advised users to verify their installed version. Checkmarx released a newer version, but did not disclose how the malicious version was published. The article does not confirm data theft or operational disruption from this plugin incident.
- Claim Status
- confirmed
People
Threat Actors
Vendors
Products
Bitwarden CLIThe incident is part of a wider TeamPCP campaign that has also hit Checkmarx’s KICS Docker image, VS Code extensions, GitHub Actions workflow, and the Bitwarden CLI npm package to steal developer secrets.GitHub Actions workflowThe incident is part of a wider TeamPCP campaign that has also hit Checkmarx’s KICS Docker image, VS Code extensions, GitHub Actions workflow, and the Bitwarden CLI npm package to steal developer secrets.Jenkins AST pluginCheckmarx confirmed that a modified version of its Jenkins AST plugin was published to the Jenkins Marketplace, and users were advised to verify they are running the safe 2.0.13-829.vc72453fa_1c16 release or earlier.KICS Docker imageThe incident is part of a wider TeamPCP campaign that has also hit Checkmarx’s KICS Docker image, VS Code extensions, GitHub Actions workflow, and the Bitwarden CLI npm package to steal developer secrets.