When a Jenkins plugin becomes a back door, the Checkmark case exposes credentials and supply chain security

During the weekend Checkmarx confirmed that a malicious version of his Jenkins plugin for Application Security Testing (AST) was published in the Jenkins Market, in addition to a chain of incidents that already includes leaks and threaded artifacts in GitHub, Docker and extension marketers. The company known as TeamPCP took advantage of credentials obtained in a previous gap - linked to the incident against Trivy - to insert code with the capacity to steal credentials in various development tools, including a version of the Checkmark plugin uploaded outside its official channel. The company's official note is available with the initial details and recommendations in its public release: Checkmark security update.

Jenkins is a pillar in many CI / CD pipelines and any component that is integrated into your workflow has access to, to a greater or lesser extent, secrets, building artifacts and deployment credentials. A backdooded plugin can not only exfiltered tokens and credentials stored in the building environment, but also act as a vector for side movements and persistence within the development infrastructure. The suspicious version published was identified as 2026.5.09 and, according to Checkmarx, did not follow the normal release procedure (without git tag or official release), while the company recommends to maintain, as far as possible, the secure version 2.0.13-829.vc72453fa _ 1c16 or an earlier one until complete remediation is confirmed. The official plugin in the Jenkins repository can be reviewed here: Checkmarx AST plugin.

Beyond the point impact, this incident highlights two critical points: the fragility of persistent credentials in repositories and the need to validate each artifact that enters the pipeline. When a credential is filtered into a link of the supply chain, the attacker can pivote multiple vectors (repos, images, extensions) and maintain access for long periods if secrets are not rotated and revoked. The message left by the attackers - accusing the lack of rotation of secrets - is a raw reminder: periodic rotations and management with expiry policies are basic but often neglected control.

If you manage Jenkins or integrate the committed plugin, assume that any secret that went through the jobs may be compromised. Immediate actions should include identifying and quarantine instances that have installed version 2026.5.09, rotating all the secrets and credentials exposed, revoking tokens and keys associated with repositories and CI / CD systems, and looking for evidence of exfiltration or persistence. Checkmark has published compromise indicators (IoCs) and malicious devices that response teams can use to investigate; it reviews its official security portal and communications to obtain these samples and signatures.

In the operational part it is appropriate to review the pipelines in search of unusual accesses, commands or external downloads executed by jobs, and to audit logs of GitHub, Docker Registry and packaging systems. Revocating and re-issuing credentials with more restrictions (limited scope, short expiry), replacing persistent credentials with temporary federated identity mechanisms (e.g., where applicable) and strengthening the segregation of environments are immediate measures to reduce the blast radius. In addition, the verification of the integrity of artifacts (signatures, checksums, reproducible buildings) and the preference for artifacts signed in the pipeline make it difficult to automatically accept unauthorized packages.

In the medium and long term, organizations must increase their safety hygiene in the supply chain: systematic implementation of policies for machine tokens in repositories, blocking of credentials in records, review of permits in service accounts, and regular audits to third parties and to the publication channels of plugins and packages. It is also time to question development processes that allow the publication of critical devices without independent security reviews or signature and traceability controls. To follow the technical trail of the commitment by independent researchers, the public evidence shared by analysts and those responsible for the disclosure can be consulted, including the thread documented by the researcher who identified the activity in GitHub: Adnan Khan in X.

Finally, although Checkmark ensures that its repositories do not contain customer data and that the development environment is separate from the production environment, the organisations must act as if they were affected if they have installed the committed plugin and complete response: detection, containment, eradication and learning. The software supply chain is now a preferred objective; reducing exposure requires both technical changes and continuous operational discipline.