TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
Executive Summary
In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. (thehackernews.com)
This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.
Why This Matters Now
The Checkmarx Jenkins plugin compromise highlights the increasing sophistication of supply chain attacks targeting CI/CD pipelines, emphasizing the urgent need for organizations to scrutinize third-party integrations and bolster their security protocols to prevent similar breaches.
Attack Path Analysis
The TeamPCP supply chain campaign began with the compromise of the Checkmarx Jenkins AST plugin and the insertion of malicious code into TanStack's npm packages. Attackers escalated privileges by exploiting CI/CD pipelines to gain unauthorized access. They moved laterally by propagating the Mini Shai-Hulud worm across npm and PyPI ecosystems. Command and control were established through malicious packages that exfiltrated developer credentials. Exfiltration occurred via the unauthorized access to internal repositories and sensitive data. The impact included potential data loss and disruption due to the worm's destructive payload targeting specific locales.
Kill Chain Progression
Initial Compromise
Description
Attackers compromised the Checkmarx Jenkins AST plugin and inserted malicious code into TanStack's npm packages.
Related CVEs
CVE-2026-45321
CVSS 9.6On May 11, 2026, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The attacker exploited multiple vulnerabilities to publish credential-stealing malware under a trusted identity.
Affected Products:
TanStack TanStack Router – 2026.5.09
Exploit Status:
exploited in the wildCVE-2026-33634
CVSS 8.8TeamPCP backdoored the Checkmarx Jenkins AST plugin and published it to the Jenkins Marketplace as version 2026.5.09. The malware harvests CI runner secrets and exfiltrates them to attacker infrastructure.
Affected Products:
Checkmarx Jenkins AST Plugin – 2026.5.09
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Valid Accounts
Modify Authentication Process: Domain Controller Authentication
Impair Defenses: Disable or Modify Tools
Indicator Removal: File Deletion
Data Destruction
Obfuscated Files or Information
Command and Scripting Interpreter: PowerShell
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure through compromised CI/CD pipelines, npm/PyPI packages, and Jenkins plugins affecting software development workflows and supply chain security.
Information Technology/IT
High risk from malicious packages with valid SLSA provenance, compromised developer tools, and credential theft targeting cloud infrastructure management.
Financial Services
Significant compliance violations through compromised zero trust controls, encrypted traffic interception, and potential PCI DSS regulatory breaches from supply chain attacks.
Health Care / Life Sciences
HIPAA compliance failures from east-west traffic compromise, encrypted data exposure, and segmentation bypass affecting patient data protection and medical system integrity.
Sources
- TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)https://isc.sans.edu/diary/rss/32994Verified
- CVE-2026-45321 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2026-45321Verified
- CVE-2026-33634: TeamPCP Backdoors Checkmarx Jenkins Plugin — CRITICAL RCE in DevOps Pipelineshttps://lyrie.ai/research/research/2026-05-12-teampcp-checkmarx-rceVerified
- Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotagedhttps://www.theregister.com/security/2026/05/11/checkmarx-tackles-another-teampcp-intrusion-as-jenkins-plugin-sabotaged/5237780Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF would likely limit the attacker's ability to exploit compromised plugins by enforcing strict workload-to-workload communication policies.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely constrain unauthorized access by enforcing least-privilege access controls within the development environment.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely limit the worm's ability to spread by monitoring and controlling internal traffic flows.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely constrain the attacker's ability to establish command and control channels by providing comprehensive monitoring across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit unauthorized data exfiltration by enforcing strict outbound traffic policies.
The implementation of CNSF controls would likely reduce the overall impact by limiting the worm's spread and data exfiltration capabilities.
Impact at a Glance
Affected Business Functions
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Software Development
- Source Code Management
- Cloud Infrastructure Management
Estimated downtime: 7 days
Estimated loss: $500,000
CI/CD secrets, cloud provider credentials, SSH keys, and source code repositories.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within CI/CD environments.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic from development environments.
- • Deploy Threat Detection & Anomaly Response systems to identify and respond to unusual activities in real-time.
- • Utilize Multicloud Visibility & Control to maintain oversight across diverse cloud platforms and detect unauthorized actions.
- • Regularly audit and rotate credentials, especially those associated with CI/CD pipelines, to mitigate the risk of unauthorized access.
