Checkmarx Jenkins AST Plugin Hit by Supply Chain Attack

A malicious version of the Checkmarx Jenkins AST Plugin was published to the Jenkins Marketplace last week, according to SecurityWeek. This incident represents a direct supply chain compromise, where attackers injected malicious code into a legitimate software component used by development teams. The compromised plugin could allow attackers to gain unauthorized access within CI/CD pipelines, a critical vector for broader system compromise.

Organizations leveraging Jenkins for their CI/CD processes and integrating Checkmarx AST for security scanning are directly exposed. The malicious plugin, once installed, could execute arbitrary code, exfiltrate sensitive data, or introduce backdoors into build artifacts. This type of attack is particularly insidious because it targets the trusted software development lifecycle, bypassing traditional perimeter defenses by compromising a legitimate tool.

Defenders must immediately audit their Jenkins environments. Any instance of the Checkmarx Jenkins AST Plugin needs to be verified for integrity. Revert to a known good version, if available, or remove the plugin until a clean, verified update is provided by Checkmarx. Assume compromise if the malicious version was ever active in your environment and initiate incident response procedures for any affected CI/CD pipelines and downstream systems.