TeamPCP, an active threat actor targeting developer security tooling, has compromised multiple Checkmarx products simultaneously, including Docker images, GitHub Actions workflows, VS Code extensions, and a spoofed npm package, in the third wave of its supply chain campaign. The attack targets the CI/CD pipelines of organizations that use Checkmarx DevSecOps tooling, meaning the very tools deployed to enforce security are being used as the entry point. Any organization running affected Checkmarx components in their software delivery pipeline should treat this as an active compromise until investigation confirms otherwise.