TeamPCP Compromised Checkmarx Jenkins AST Plugin Following KICS Supply Chain Attack

A coordinated supply-chain compromise beginning in March 2026 led to malicious modifications of Checkmarx developer artifacts (including a Jenkins AST plugin published to the Jenkins Marketplace on 2026.5.09) and related tooling (Docker KICS image, GitHub Action, VS Code extensions), enabling credential and secret harvesting across CI/CD and developer environments; Checkmarx confirmed affected artifact hashes, exposed domains/IPs, and recommended rotation of potentially exposed credentials and blocking access to attacker-controlled domains.