US EditionBitwarden CLI npm package compromised to steal developer credentials
14 Articles
14 Articles
An updated package on a code repository was enough to turn a trusted tool into a data thief. An attack on the supply chain that hit Bitwarden CLI.
Bitwarden CLI Backdoored: Shai-Hulud Returns Through a 93-Minute npm Window
Between 21:57 and 23:30 UTC on April 22, 2026, a malicious @bitwarden/cli@2026.4.0 was live on npm for 93 minutes — long enough to reach CI/CD pipelines, developer workstations, and cloud automation hosts. The payload steals credentials across GitHub, AWS, GCP, and Azure, propagates as a self-replicating npm worm, injects GitHub Actions workflow stealers, and poisons AI coding assistants by injecting an invisible manifesto into shell configurati…
If you installed Bitwarden CLI via npm between 5:57 pm and 7:30 pm PM (New York time) on April 22, you have to clean up on your machine as a matter of urgency!! Indeed, the @bitwarden/cli version 2026.4.0 package was compromised for 93 minutes, and the malware that was there caused damage to the 334 people who downloaded it during this window. But what is this story again? Well, many attackers managed to trap Bitwarden's GitHub Actions pipeline,…
Socket, a company specializing in open-source software security, has announced that its password manager, Bitwarden, was subjected to a supply chain attack.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
