Up to date with additional info from Bitwarden.
The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli bundle to npm containing a credential-stealing payload able to spreading to different tasks.
Based on reviews by Socket, JFrog, and OX Safety, the malicious bundle was distributed as model 2026.4.0 and remained accessible between 5:57 PM and seven:30 PM ET on April 22, 2026, earlier than being eliminated.
Bitwarden confirmed the incident, stating that the breach affected solely its npm distribution channel for the CLI npm bundle and solely those that downloaded the malicious model.
“The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious npm release was deprecated, and remediation steps were initiated immediately,” Bitwarden shared in an announcement.
“The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data.”
Bitwarden says it revoked the compromised entry and deprecated the affected CLI npm launch.
The Bitwarden provide chain assault
Based on Socket, risk actors seem to have used a compromised GitHub Motion in Bitwarden’s CI/CD pipeline to inject malicious code into the CLI npm bundle.
Based on JFrog, the bundle was modified in order that the preinstall script and the CLI entry level use a customized loader named bw_setup.js, which checks for the Bun runtime and, if it doesn’t exist, downloads it.
The loader then makes use of the Bun runtime to launch an obfuscated JavaScript file named bw1.js, which acts as credential-stealing malware.
Supply: Jfrog
As soon as executed, the malware collects a variety of secrets and techniques from contaminated programs, together with npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud.
The malware encrypts the collected knowledge utilizing AES-256-GCM and exfiltrates it by creating public GitHub repositories beneath the sufferer’s account, the place the encrypted knowledge is saved.
OX Safety says that these created repositories include the string “Shai-Hulud: The Third Coming,” a reference to earlier npm provide chain assaults that used an identical methodology and textual content string when exfiltrating stolen knowledge.
Supply: OX Safety
The malware additionally options self-propagation capabilities, with OX Safety reporting that it could use stolen npm credentials to determine packages the sufferer can modify and inject them with malicious code.
Socket additionally noticed that the payload targets CI/CD environments and makes an attempt to reap secrets and techniques that may be reused to broaden the assault.
The assault comes after Checkmarx disclosed a separate provide chain incident yesterday that impacts its KICS Docker photos, GitHub Actions, and developer extensions.
Whereas it’s not identified precisely how attackers gained entry, Bitwarden advised BleepingComputer the incident was linked to the Checkmarx provide chain assault, with a compromised Checkmarx-related improvement software enabling abuse of the npm supply path for the CLI throughout a restricted time window.
Socket advised BleepingComputer that there are overlapping indicators between the Checkmarx breach and this assault.
“The connection is at the malware and infrastructure level. In the Bitwarden case, the malicious payload uses the same audit.checkmarx[.]cx/v1/telemetry endpoint that appeared in the Checkmarx incident. It also uses the same __decodeScrambled obfuscation routine with the seed 0x3039, and shows the same general pattern of credential theft, GitHub-based exfiltration, and supply chain propagation behavior,” Socket advised BleepingComputer.
“That overlap goes beyond a superficial resemblance. The Bitwarden payload contains the same kind of embedded gzip+base64 components we saw in the earlier malware, including tooling for credential collection and downstream abuse.”
Each campaigns have been linked to a risk actor generally known as TeamPCP, who beforehand focused developer packages within the huge Trivy and LiteLLM provide chain assaults.
Builders who put in the affected model ought to deal with their programs and credentials as compromised and rotate all uncovered credentials, particularly these used for CI/CD pipelines, cloud storage, and developer environments.
Replace 4/23/26: Up to date the story with info from Bitwarden confirming the incident was linked to the Checkmarx provide chain assault.
AI chained 4 zero-days into one exploit that bypassed each renderer and OS sandboxes. A wave of latest exploits is coming.
On the Autonomous Validation Summit (Could 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls maintain, and closes the remediation loop.
Declare Your Spot
