[2026] Bitwarden CLI npm Compromised in Supply Chain Attack
Two hours. That's all it took for attackers to slip malicious code into Bitwarden's CLI npm package, turning a trusted password tool against developers. Credentials flew out—npm tokens, SSH keys, cloud secrets—and self-propagated to other projects.
⚡ Key Takeaways
- Malicious @bitwarden/cli v2026.4.0 stole creds, self-propagated via npm tokens in 1.5-hour window. 𝕏
- Linked to Checkmarx breach by TeamPCP; same malware patterns, exfil methods. 𝕏
- No vault data hit, but devs must rotate all secrets immediately—CI/CD most at risk. 𝕏
- npm's trust model failing; expect push for signed artifacts and secure tiers. 𝕏
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by Bleeping Computer
Related Stories
Data Breaches
[2026] Checkmarx KICS Supply-Chain Hack Steals Secrets in 84 Minutes
Nation-State Threats
TeamPCP's Ruthless Hijack of Security Scanners: 500K Machines, 300GB Stolen
Cloud Security
TeamPCP's Supply Chain Onslaught Hits Databricks, Splits Ransomware Into Two Deadly Tracks
Data Breaches