Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack
Checkmarx on Friday warned users that a malicious version of its Jenkins AST plugin was published as part of a supply chain attack.
The plugin enables users to integrate the functionality of the Checkmarx One platform into Jenkins pipelines, allowing them to scan source code using the Checkmarx AST platform.
“We are aware that a modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace. We are in the process of publishing a new version of this plugin,” Checkmarx said on Friday.
The company told users to ensure they are running version 2.0.13-829.vc72453fa_1c16 of the Jenkins AST plugin, which was published in December 2025.
Over the weekend, Checkmarx released two new versions of the plugin. The latest iteration, 2.0.13-848.v76e89de8a_053, is now available on both GitHub and the Jenkins Marketplace.
Checkmarx has not shared information on how the malicious plugin version was published, but the incident is...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
