Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

Apr 23, 2026•tosh•View Original

TL;DR Highlight

Bitwarden CLI npm 2026.4.0 was infected through an abused GitHub Action in its CI/CD pipeline.

Who Should Read

Backend/DevOps developers who auto-install npm packages in CI and locally while holding Claude/MCP configs and cloud credentials

Core Mechanics

Only @bitwarden/cli 2026.4.0 is affected
- The malicious code sat in bw1.js inside the package contents.
- Socket says a compromised GitHub Action in Bitwarden's CI/CD pipeline appears to have been abused.
- Only the npm package is involved; the Chrome extension, MCP server and other distributions are not yet affected.
The credential sweep is wide
- It collects GitHub tokens, AWS/Azure/GCP credentials, .npmrc, SSH keys and environment variables.
- Claude/MCP configuration files are also targeted.
- GitHub tokens are also taken via Runner.Worker memory scraping.
Exfiltration goes through public GitHub repos
- It creates public repos under victim accounts named {word}-{word}-{3digits} with Dune-themed words.
- Encrypted results are committed, and tokens go into commit messages with the marker LongLiveTheResistanceAgainstMachines.
- C2 is audit.checkmarx[.]cx/v1/telemetry.
It spreads to other packages
- Stolen npm tokens are used to find writable packages and republish them with preinstall hooks.
- It injects GitHub Actions workflows to capture repository secrets.
Persistence via shell profiles
- The payload is injected into ~/.bashrc and ~/.zshrc.
- /tmp/tmp.987654321.lock prevents duplicate runs.
- It exits silently when the system locale starts with ru.
Same tooling as yesterday's Checkmarx attack
- The C2 endpoint and obfuscation match Checkmarx's mcpAddon.js.
- This payload embeds ideological branding such as Shai-Hulud: The Third Coming.
- Socket says attribution is complicated and does not conclude it is the same operator.

Community Reactions

Opinion that min-release-age would have helped
- A commenter said min-release-age=7 in .npmrc (npm 11.10+) would have protected the 334 people who downloaded the bad version.
- Equivalent settings for pnpm, bun and uv were shared.
- They noted axios and ua-parser-js bad versions were pulled within hours, but event-stream sat for 2+ months.
Point that preinstall makes install itself the attack
- A commenter argued post-install inspection is too late, and agents, CI and ephemeral sandboxes install automatically and repeatedly.
- They also worried shell-profile tampering could poison what the next coding assistant reads into context.
Experience with pinning and Actions hygiene
- A commenter said ^ ranges can pull in newer versions when the lockfile updates, so pin critical dependencies.
- Another said they stopped using even GitHub's checkout action and do the checkout manually.
- Another countered that hash pinning does not help against poisoned-at-origin uploads.
Alternatives suggested
- Commenters mentioned rbw (a Rust client) and pass/gopass synced via a private git repo.
- One commenter confirmed Raycast's bundled bitwarden-cli is not the compromised version.

How to Apply

Set a minimum release age in your package manager
- Today, add min-release-age=7 to ~/.npmrc (npm 11.10+).
- For pnpm use minimum-release-age=10080 (minutes), for bun minimumReleaseAge=604800 (seconds), for uv exclude-newer="7 days".
Check install history and infection traces
- Find dev machines and CI runners that installed @bitwarden/cli 2026.4.0.
- Check for /tmp/tmp.987654321.lock and changes to ~/.bashrc and ~/.zshrc.
- Search logs for outbound connections to audit.checkmarx[.]cx and 94[.]154[.]172[.]43.
Rotate every secret that may have been exposed
- Rotate GitHub and npm tokens, cloud credentials, SSH keys and CI secrets from affected environments.
- Check GitHub for new public repos with Dune-term names and unapproved files under .github/workflows/.
Shrink GitHub Actions permissions and token scope
- Set workflow permissions to the minimum and pin third-party actions to commit hashes.
- Use short-lived credentials where possible and restrict who can publish packages.

Try It

copy & run

# Paste into your terminal: quick check for infection traces (macOS/Linux)

npm ls -g @bitwarden/cli 2>/dev/null | grep 2026.4.0 && echo "[!] Infected version installed"
find . -path '*/node_modules/@bitwarden/cli/package.json' -exec grep -H '"version"' {} \; 2>/dev/null
[ -f /tmp/tmp.987654321.lock ] && echo "[!] Lock file found"
grep -nE 'bw1\.js|checkmarx\.cx' ~/.bashrc ~/.zshrc 2>/dev/null
ls -d /tmp/_tmp_* 2>/dev/null

# Set npm minimum release age (npm 11.10+)
npm config set min-release-age 7

Terminology

Supply chain attackPoisoning a library or build tool at its source so everyone who installs it gets infected. It's like a package that was already tainted before it was delivered.

preinstall hookA script npm runs automatically right before installing a package. Code runs just from installing.

IOCIndicators of compromise: traces that tell you whether you were infected, such as malicious file paths, IPs and domains.

C2Command-and-control: the attacker's server where malware sends stolen data and receives commands.

min-release-ageA setting that blocks installing newly published package versions for a set period. Like waiting for a new product to be vetted before buying.

Related Resources

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

Apr 23, 2026•tosh•View Original

TL;DR Highlight

Bitwarden CLI npm 2026.4.0 was infected through an abused GitHub Action in its CI/CD pipeline.

Who Should Read

Backend/DevOps developers who auto-install npm packages in CI and locally while holding Claude/MCP configs and cloud credentials

Core Mechanics

Only @bitwarden/cli 2026.4.0 is affected
- The malicious code sat in bw1.js inside the package contents.
- Socket says a compromised GitHub Action in Bitwarden's CI/CD pipeline appears to have been abused.
- Only the npm package is involved; the Chrome extension, MCP server and other distributions are not yet affected.
The credential sweep is wide
- It collects GitHub tokens, AWS/Azure/GCP credentials, .npmrc, SSH keys and environment variables.
- Claude/MCP configuration files are also targeted.
- GitHub tokens are also taken via Runner.Worker memory scraping.
Exfiltration goes through public GitHub repos
- It creates public repos under victim accounts named {word}-{word}-{3digits} with Dune-themed words.
- Encrypted results are committed, and tokens go into commit messages with the marker LongLiveTheResistanceAgainstMachines.
- C2 is audit.checkmarx[.]cx/v1/telemetry.
It spreads to other packages
- Stolen npm tokens are used to find writable packages and republish them with preinstall hooks.
- It injects GitHub Actions workflows to capture repository secrets.
Persistence via shell profiles
- The payload is injected into ~/.bashrc and ~/.zshrc.
- /tmp/tmp.987654321.lock prevents duplicate runs.
- It exits silently when the system locale starts with ru.
Same tooling as yesterday's Checkmarx attack
- The C2 endpoint and obfuscation match Checkmarx's mcpAddon.js.
- This payload embeds ideological branding such as Shai-Hulud: The Third Coming.
- Socket says attribution is complicated and does not conclude it is the same operator.

Community Reactions

Opinion that min-release-age would have helped
- A commenter said min-release-age=7 in .npmrc (npm 11.10+) would have protected the 334 people who downloaded the bad version.
- Equivalent settings for pnpm, bun and uv were shared.
- They noted axios and ua-parser-js bad versions were pulled within hours, but event-stream sat for 2+ months.
Point that preinstall makes install itself the attack
- A commenter argued post-install inspection is too late, and agents, CI and ephemeral sandboxes install automatically and repeatedly.
- They also worried shell-profile tampering could poison what the next coding assistant reads into context.
Experience with pinning and Actions hygiene
- A commenter said ^ ranges can pull in newer versions when the lockfile updates, so pin critical dependencies.
- Another said they stopped using even GitHub's checkout action and do the checkout manually.
- Another countered that hash pinning does not help against poisoned-at-origin uploads.
Alternatives suggested
- Commenters mentioned rbw (a Rust client) and pass/gopass synced via a private git repo.
- One commenter confirmed Raycast's bundled bitwarden-cli is not the compromised version.

How to Apply

Set a minimum release age in your package manager
- Today, add min-release-age=7 to ~/.npmrc (npm 11.10+).
- For pnpm use minimum-release-age=10080 (minutes), for bun minimumReleaseAge=604800 (seconds), for uv exclude-newer="7 days".
Check install history and infection traces
- Find dev machines and CI runners that installed @bitwarden/cli 2026.4.0.
- Check for /tmp/tmp.987654321.lock and changes to ~/.bashrc and ~/.zshrc.
- Search logs for outbound connections to audit.checkmarx[.]cx and 94[.]154[.]172[.]43.
Rotate every secret that may have been exposed
- Rotate GitHub and npm tokens, cloud credentials, SSH keys and CI secrets from affected environments.
- Check GitHub for new public repos with Dune-term names and unapproved files under .github/workflows/.
Shrink GitHub Actions permissions and token scope
- Set workflow permissions to the minimum and pin third-party actions to commit hashes.
- Use short-lived credentials where possible and restrict who can publish packages.

Try It

copy & run

# Paste into your terminal: quick check for infection traces (macOS/Linux)

npm ls -g @bitwarden/cli 2>/dev/null | grep 2026.4.0 && echo "[!] Infected version installed"
find . -path '*/node_modules/@bitwarden/cli/package.json' -exec grep -H '"version"' {} \; 2>/dev/null
[ -f /tmp/tmp.987654321.lock ] && echo "[!] Lock file found"
grep -nE 'bw1\.js|checkmarx\.cx' ~/.bashrc ~/.zshrc 2>/dev/null
ls -d /tmp/_tmp_* 2>/dev/null

# Set npm minimum release age (npm 11.10+)
npm config set min-release-age 7

Terminology

Supply chain attackPoisoning a library or build tool at its source so everyone who installs it gets infected. It's like a package that was already tainted before it was delivered.

preinstall hookA script npm runs automatically right before installing a package. Code runs just from installing.

IOCIndicators of compromise: traces that tell you whether you were infected, such as malicious file paths, IPs and domains.

C2Command-and-control: the attacker's server where malware sends stolen data and receives commands.

min-release-ageA setting that blocks installing newly published package versions for a set period. Like waiting for a new product to be vetted before buying.

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources