Ethical Hacking News
In a shocking turn of events, the Bitwarden CLI package has been compromised as part of the ongoing Checkmarx supply chain campaign. The attack leveraged a compromised GitHub Action and stole sensitive data, including developer secrets, GitHub Actions environments, and cloud secrets. No end-user data was accessed, but the incident highlights the importance of secure software development practices and the need for developers to stay vigilant when it comes to open-source dependencies.
A recent attack on the Bitwarden CLI package highlighted vulnerabilities in open-source software supply chain attacks.The malicious code was published in 'bw1.js' and stole GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions, and cloud secrets.The attack compromised a compromised GitHub Action in Bitwarden's CI/CD pipeline, consistent with other affected repositories in the Checkmarx supply chain campaign.User data was publicly exfiltrated to GitHub, posing significant risks due to security tools not flagging data being sent there.The incident highlights the importance of secure software development practices and staying vigilant with open-source dependencies.
In a developing story that highlights the ongoing vulnerabilities in the world of open-source software, a recent attack on the Bitwarden CLI package has shed light on the dark side of supply chain attacks. As part of an extensive investigation by JFrog and Socket, it was discovered that the malicious version of the @bitwarden/cli@2026.4.0 package had been compromised as part of the Checkmarx supply chain campaign.
According to the researchers, the attack leveraged a compromised GitHub Action in Bitwarden's CI/CD pipeline, consistent with the pattern seen across other affected repositories in this campaign. The malicious code was published in 'bw1.js,' a file included in the package contents, which stole GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets, then exfiltrated the data to private domains and as GitHub commits.
The entire series of actions can be broken down into several stages. First, it launches a credential stealer that targets developer secrets, GitHub Actions environments, and artificial intelligence (AI) coding tool configurations, including Claude, Kiro, Cursor, Codex CLI, and Aider. The stolen data is then encrypted with AES-256-GCM and exfiltrated to audit.checkmarx[.]cx, a domain impersonating Checkmarx.
Furthermore, if GitHub tokens are found, the malware weaponizes them to inject malicious Actions workflows into repositories and extract CI/CD secrets. According to security researcher Adnan Khan, the threat actor is said to have used a malicious workflow to publish the malicious bitwarden CLI. "I believe this is the first time a package using NPM trusted publishing has been compromised," Khan added.
The Checkmarx supply chain attack campaign has already made headlines in recent months, with multiple instances of compromised repositories and affected packages discovered. The Shai-Hulud incident mentioned by OX Security seems to be part of an ongoing series of threats targeting developers around the world.
User data is being publicly exfiltrated to GitHub, often going undetected because security tools typically don't flag data being sent there. This makes the risk significantly more dangerous: anyone searching GitHub can potentially find and access those credentials. At that point, sensitive data is no longer in the hands of a single threat actor – it’s exposed to anyone.
The incident also highlights the importance of secure software development practices and the need for developers to stay vigilant when it comes to open-source dependencies. As the world becomes increasingly dependent on technology, vulnerabilities like this can have serious consequences.
In response to the attack, Bitwarden confirmed that the incident stemmed from the compromise of its npm distribution mechanism following the Checkmarx supply chain attack. However, they emphasized that no end-user data was accessed as part of the attack. The entire statement shared with The Hacker News is reproduced verbatim below -
"The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/cli@2026.4.0 between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident.
The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious npm release was deprecated, and remediation steps were initiated immediately.
The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data.
Users who did not download the package from npm during that window were not affected. Bitwarden has completed a review of internal environments, release paths, and related systems, and no additional impacted products or environments have been identified at this time. A CVE for Bitwarden CLI version 2026.4.0 is being issued in connection with this incident.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Shai-Hulud-Supply-Chain-Threat-Uncovering-the-Latest-Checkmarx-Attack-and-the-Bitwarden-CLI-Compromise-ehn.shtml
Published: Thu Apr 23 11:25:25 2026 by llama3.2 3B Q4_K_M
