Checkmarx Jenkins Plugin Compromised by TeamPCP Malware

Checkmarx, known for application security testing, recently faced a serious security breach. Over the weekend, the company warned that a rogue version of its Jenkins Application Security Testing (AST) plugin was uploaded to the Jenkins Marketplace. It was compromised with credential-stealing malware, claimed by the TeamPCP hacker group.

Jenkins, a popular CI/CD automation tool, integrates with various development environments to automate software building and deployment. The Checkmarx AST plugin is popular for adding security scanning to these workflows.

The Compromise Uncovered

TeamPCP infiltrated Checkmarx's GitHub repositories, exploiting credentials from a supply-chain attack on Trivy in March. With access, they inserted malicious code into the Jenkins AST plugin, spreading info-stealing malware.

Checkmarx confirmed that the altered plugin was uploaded outside the official release pipeline and lacked the usual git tag or GitHub release markers. Affected users should revert to version 2.0.13-829.vc72453fa_1c16 or earlier.

Implications and Recommendations

This attack is the third supply-chain breach impacting Checkmarx since late March. TeamPCP retained access for a month, targeting tools like Docker and VSCode with similar payloads. If you downloaded the compromised plugin, assume your credentials are compromised. Rotate secrets and watch for unauthorized access.

Checkmarx says its GitHub repositories are isolated from customer environments, reducing risk to customer data. They've communicated with customers and provided guidance via their Support Portal.

Background:

Supply-chain attacks like TeamPCP's are increasingly common, targeting vulnerabilities in software distribution. By compromising updates or plugins, attackers can infiltrate development environments, leading to data breaches and system compromises.

What's still unclear:

• What exactly the rogue Jenkins plugin does upon installation.
• If other Checkmarx tools are compromised.
• The full extent of accessed or stolen data.

Why this matters:

This incident shows the persistent threat of supply-chain attacks to software security. As CI/CD tools are key to modern development, their integrity is crucial. Organizations must audit their software supply chains and address vulnerabilities swiftly.