Executive Summary
Checkmarx identified a multi-stage supply chain incident starting in March 2026, where the 'TeamPCP' attack vector was used to gain unauthorized access to Checkmarx's GitHub repositories. This access allowed threat actors to inject malicious code into several developer tools, including GitHub Actions, VS Code extensions, and the Jenkins AST plugin. While Checkmarx maintains its customer production environments separately from GitHub, evidence indicates that internal data was exfiltrated on March 30, 2026.
In late April 2026, the LAPSUS$ group published stolen data on the dark web, confirming a breach of the development environment. The malicious artifacts were primarily designed to harvest environment variables and secrets (such as AWS/Azure keys and GitHub tokens) from customer CI/CD runners and developer workstations. Organizations using affected versions of Checkmarx plugins or GitHub Actions during the specified windows must treat their secrets as compromised and perform immediate rotation and environment audits.