Breaking News — April 23, 2026
Bitwarden CLI has been compromised as part of the ongoing Checkmarx supply chain campaign, according to new findings from JFrog and Socket.
Key Details
- Affected version: @bitwarden/cli@2026.4.0
- Malicious file: bw1.js — included in package contents
- Attack vector: Compromised GitHub Action in Bitwarden's CI/CD pipeline
- Data stolen: GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets
How It Works
The malicious code is executed via a preinstall hook, resulting in the theft of local, CI, GitHub, and cloud secrets. Data is exfiltrated to private domains and as GitHub commits.
JFrog confirmed the rogue version steals credentials and exfiltrates them to attacker-controlled domains.
Impact
This is part of a broader Checkmarx supply chain campaign that has affected multiple popular developer tools. The attack leverages compromised CI/CD pipelines to inject malicious code into trusted packages.
Source: The Hacker News / JFrog / Socket