TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Checkmarx confirmed that a maliciously modified Jenkins AST plugin was published to the Jenkins Marketplace by the group known as TeamPCP; the report links this incident to a broader supply-chain campaign that previously compromised a KICS Docker image, VS Code extensions, a GitHub Actions workflow, and briefly the Bitwarden CLI npm package to deploy credential-stealing malware, suggesting active exploitation and possible incomplete remediation.