Skip to content
topics.

Bitwarden CLI 2026.4.0 compromised in Checkmarx supply chain attack

devApr 23, 202675

Attackers injected malicious code into the Bitwarden CLI npm package @bitwarden/cli@2026.4.0 by abusing a GitHub Action in Bitwarden's CI/CD pipeline. The compromised release exfiltrated secrets from build environments and delivered credential‑stealing malware to downstream users. Bitwarden's security team discovered the compromise on April 23 and linked it to the ongoing Checkmarx supply‑chain campaign. The incident threatens exposed API keys and crypto wallet credentials for projects that used the CLI and highlights attackers targeting CI/CD workflows.

j
@zerojay.com

Linux nerds like me, be aware that Bitwarden's cli app was compromised: socket.dev/blog/bitward...

44h ago
IFIN
@ifin-intel.org

Bitwarden's CLI NPM package was hijacked and used to spread credential stealer malware. This is related to the previous Checkmarx compromise. We'll be updating this thread as always with new information. Come join the effort!

15h ago
The Lobste.rs RSS feed
@lobsters-feed.bsky.social

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain https://lobste.rs/s/x79usb #security

5h ago
Ray?
@demios.bsky.social

Supply chain attacks are getting to be a headache for enterprise situations. Much like the npm one, this leans on someone writing malicious code in a library/package used by other things. socket.dev/blog/bitward...

4h ago
cryptotrendnews.bsky.social
@cryptotrendnews.bsky.social

Bitwarden CLI supply chain attack puts cryptocurrency wallet keys at risk The attackers chose the interface version Commands from the password manager. The security team discovered the hack on April 23 and linked it to the TeamPCP Altored chain campaign. ركّز البرمجية الخبيثة على تعليقة الديكورية…

5h ago
Sam Stepanyan
@securestep9.bsky.social

#Bitwarden CLI was compromised in a supply chain attack! @bitwarden/cli@2026.4.0 included malicious code: #SoftwareSupplyChainSecurity 👇 thehackernews.com/2026/04/bitw...

5h ago
Silas
@sy-bersecurity.bsky.social

Bitwarden CLI compromised due to the Checkmarx incident. Ruh roh!

4h ago
3 sources
thehackernews.comBitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaignsocket.devBitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...cryptotrendnews.siteBitwarden CLI supply chain attack puts cryptocurrency wallet keys at risk

Related

Anthropic publishes Claude Code post‑mortem and issues fixesdevUbuntu 26.04 LTS, 'Resolute Raccoon' releaseddevBitwarden CLI 2026.4.0 compromised in Checkmarx supply chain attackdev