Checkmarx

Checkmarx suffered a supply chain incident where attackers gained unauthorized access to GitHub repositories, likely via the TeamPCP attack on Trivy scanner, leading to publication of malicious Jenkins AST plugin artifacts. Customer data was not stored in the affected repositories, but data exfiltration occurred on March 30, 2026, with stolen data later published by LAPSUS$.