Checkmarx supply-chain compromise publishes malicious developer artifacts across March-May

Checkmarx identified on 23 March 2026 a supply-chain incident originating from the Trivy compromise; attackers gained unauthorized GitHub access, published malicious Checkmarx actions and extensions and exfiltrated repository data. Continued access produced another wave of malicious artifacts on 22 April, and Checkmarx later assessed that access obtained in the March incident was used to publish a malicious Jenkins AST plugin on 9 May. Bitwarden separately linked a malicious CLI package to a compromised Checkmarx dependency.