Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Back Thehackernews

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Thehackernews •[email protected] (The Hacker News) • April 23, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bitwarden CLI Compromised in Supply Chain Attack via npm A malicious version of the Bitwarden CLI password manager was distributed via npm, affecting version 2026.4.0 for a brief window on April 22, 2026. The attack exploited a compromised GitHub Action in Bitwarden's CI/CD pipeline, allowing attackers to inject a credential-stealing payload named bw1.js. This malware targeted sensitive developer credentials, including GitHub tokens, AWS and Azure credentials, and SSH keys. Bitwarden confirmed that no end-user vault data was accessed, and production systems remained secure. The malicious package was available for 93 minutes before being removed, and affected users are advised to uninstall the compromised version and rotate their credentials. This incident is linked to a broader supply chain attack involving Checkmarx, which has been under scrutiny for multiple security breaches. The attack highlights the risks associated with CI/CD environments and the potential for widespread credential theft. 18 sources 74

Extracted Entities

Attack Types (1)

Supply Chain Attack

Campaigns (1)

Checkmarx Supply Chain Campaign

Platforms (1)

Tools (1)