Checkmarx, a software security firm, has been hit by yet another cyberattack, this time targeting its Jenkins plugin. The incident, which occurred over the weekend, has raised concerns about the security of DevOps tools and the potential for supply chain attacks. The attack involved a modified version of the Checkmarx Jenkins AST plugin being published to the Jenkins Marketplace, which could have severe implications for Jenkins users.
The plugin, which is used for security scans in Jenkins CI pipelines, was compromised by TeamPCP, a group known for their supply chain attacks. This is the third time TeamPCP has targeted Checkmarx in the past few months, and the second time they've compromised the company's packages. The attack is particularly concerning because the plugin is installed by several hundred controllers and remains available on the Jenkins Marketplace.
What makes this attack even more dangerous is the trust model involved. The Checkmarx Jenkins plugin is designed to improve the security of Jenkins pipelines, but a backdoored version can compromise the entire system. It can ride trusted infrastructure into every build pipeline it touches, gaining access to sensitive information such as source code, environment variables, tokens, and secrets.
This is not the first time TeamPCP has used malware named after the Dune novel 'Shai-Hulud'. In September last year, they compromised hundreds of npm packages, and in November, they affected over 25,000 GitHub repos. The Mini Shai-Hulud packages were later injected into Checkmarx's Jenkins plugin, and they also hit SAP npm packages in the TeamPCP supply chain attacks.
Security engineer Adnan Khan quickly spotted the compromise, and SOCRadar noted that the latest TeamPCP compromise suggests either that TeamPCP was telling the truth about Checkmarx's secrets rotation or that they found an additional persistence mechanism that the security vendor missed. This incident highlights the ongoing challenges in securing DevOps tools and the need for constant vigilance in the face of evolving cyber threats.
