Malicious Checkmarx Jenkins AST Plugin Published in Supply-Chain Attack

Summary

Checkmarx warned that a malicious Jenkins AST plugin version was published. It advised users to update and released a newer version; the company has not explained how the malicious version was published.

Key points

Checkmarx said a modified, malicious version of its Jenkins AST plugin was published to the Jenkins Marketplace.
The plugin integrates Checkmarx One scanning into Jenkins pipelines.
Checkmarx advised users to run version 2.0.13-829.vc72453fa_1c16 and later released version 2.0.13-848.v76e89de8a_053.
The company has not disclosed how the malicious version was published.
The incident is linked to a broader supply-chain attack: TeamPCP reportedly accessed Checkmarx repositories after the Trivy attack and published malicious artifacts.
Checkmarx previously said data was likely stolen from its GitHub repositories using credentials compromised in the Trivy attack; Lapsus$ later claimed to release data allegedly stolen from the company.

Article Details

Victim Organization: Checkmarx
Incident Type: Supply chain attack involving publication of a malicious version of the Checkmarx Jenkins AST plugin
Operational Impact: A malicious plugin version was published to the Jenkins Marketplace. Checkmarx advised users to run version 2.0.13-829.vc72453fa_1c16 and subsequently released newer versions.
Ransom Or Extortion: Lapsus$ publicly released data allegedly stolen from Checkmarx's repositories. The article does not report a ransom demand.
Claim Status: confirmed

Threat Actors

LAPSUS$The article reports that Lapsus$ publicly released data allegedly stolen from Checkmarx's repositories; the theft is not presented as independently confirmed.TeamPCPThe article reports that TeamPCP accessed Checkmarx's repositories in late March following the Trivy supply chain attack and published malicious artifacts.

Vendors

CheckmarxCheckmarx on Friday warned users that a malicious version of its Jenkins AST plugin was published as part of a supply chain attack.

Products

Checkmarx ASTThe plugin enables users to integrate the functionality of the Checkmarx One platform into Jenkins pipelines, allowing them to scan source code using the Checkmarx AST platform.Checkmarx OneThe plugin enables users to integrate the functionality of the Checkmarx One platform into Jenkins pipelines, allowing them to scan source code using the Checkmarx AST platform.JenkinsCheckmarx on Friday warned users that a malicious version of its Jenkins AST plugin was published as part of a supply chain attack.Jenkins AST pluginCheckmarx on Friday warned users that a malicious version of its Jenkins AST plugin was published as part of a supply chain attack.