---
title: Checkmarx Jenkins Plugin Hit by Supply Chain Attack
description: Hackers published a malicious Checkmarx Jenkins AST plugin; users urged to update and rotate every credential their CI runners could reach.
canonical_url: https://codekeeper.co/ticker/checkmarx-jenkins-plugin-supply-chain-attack
---

# Checkmarx Jenkins Plugin Hit by Supply Chain Attack

Hackers published a malicious Checkmarx Jenkins AST plugin; users urged to update and rotate every credential their CI runners could reach.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 11, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Checkmarx warned users on May 9 that hackers had published a malicious version of its Jenkins AST plugin — 2026.5.09 — to the Jenkins Marketplace. The plugin, which wires Checkmarx One scanning into Jenkins pipelines, carried a stealer going after crypto wallets, VPN configs, and AWS and GitHub credentials on Windows, Linux and macOS. The company told users to fall back to version 2.0.13-829.vc72453fa_1c16 from December 2025, then released two newer builds over the weekend; 2.0.13-848.v76e89de8a_053 is now on GitHub and the Jenkins Marketplace. Updating isn't enough on its own — Checkmarx says to rotate every secret its CI runners could reach, from GitHub tokens to cloud and Kubernetes credentials. The compromise traces back to March's Trivy supply chain attack, which handed TeamPCP the credentials to reach Checkmarx's GitHub repositories. Malicious artifacts followed in late March and again on April 22, and Checkmarx says LAPSUS$ published the stolen data on April 25. _Updated August 13, 2026: Mandiant confirmed the incident contained on June 4, and Checkmarx announced its investigation complete on July 6._ **Source:** [Security Week](https://www.securityweek.com/checkmarx-jenkins-ast-plugin-compromised-in-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcheckmarx-jenkins-plugin-supply-chain-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Meta Patched a Flaw That Let Attackers Hijack Its AI Agent Sep 22, 2026](https://codekeeper.co/ticker/zero-day-vulnerability-meta-muse-ai-macos)

[University of Nottingham Students 'Scared and Anxious' After Major Cyber-Attack Aug 12, 2026](https://codekeeper.co/ticker/university-of-nottingham-hack-student-data-breach)

[Hackers Are Using Fake OpenAI Organizations to Silently Steal Your Work Data Aug 12, 2026](https://codekeeper.co/ticker/hackers-exploit-openai-notifications)

[Silent Ransom Group Targets US Law Firms with Rapid Extortion Attacks Aug 12, 2026](https://codekeeper.co/ticker/silent-ransom-targets-us-firms-2026)