Embedded Malicious Code Affecting com.checkmarx.jenkins:checkmarx-ast-scanner package, versions [2026.5.09]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-COMCHECKMARXJENKINS-16624490
- published10 May 2026
- disclosed8 May 2026
- creditUdi-Yehuda Tamar
Introduced: 8 May 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the com.checkmarx.jenkins:checkmarx-ast-scanner package.
Overview
com.checkmarx.jenkins:checkmarx-ast-scanner is a plugin that allows the user to scan their source code using Checkmarx AST platform and provide the results as a feedback.
Affected versions of this package are vulnerable to Embedded Malicious Code. A version of the Checkmarx Jenkins AST plugin was published on the Jenkins Plugin Marketplace containing malicious code intended to scrape and exfiltrate secrets from the Jenkins environment. This is associated with a string of compromises of packages in the Checkmarx ecosystem, including plugins for VSCode and Jenkins, as well as KICS Docker image releases and GitHub Actions, in a campaign attributed to TeamPCP.
The project maintainers recommend downgrading the plugin to version 2.0.13-829.vc72453fa_1c16.