You say "Jenkins server" as if there's a CI setup involved. I wouldn't be surprised if, in many cases, these companies just have whoever touched the code last

You say "Jenkins server" as if there's a CI setup involved. I wouldn't be surprised if, in many cases, these companies just have whoever touched the code last run a build on their computer and ship that. (Which probably explains how some of the malware got there.)