|
Internet Search Results
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...
Bitwarden CLI, the command-line interface for the password manager Bitwarden, has reportedly been compromised as part of a newly discovered and ongoing Checkmarx supply chain campaign, according to findings from JFrog and Socket. "The affected package version appears to be @bitwarden/cli@2026.4.0 ...
TeamPCP Campaign Spreads to npm via a Hijacked Bitwarden CLI
JFrog security researchers identified a hijacked npm package published as @bitwarden/cli version 2026.4.0, impersonating the legitimate Bitwarden command line client. The package keeps the expected Bitwarden metadata, but rewires both preinstall and the bw binary entrypoint to a custom loader, bw_setup.js, instead of the legitimate bundled CLI.
Bitwarden CLI compromise infects hundreds of developers with ...
Hackers injected credential-stealing malware into the Bitwarden CLI tool via a supply chain attack on the NPM package, affecting hundreds of developers.
Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer ...
@bitwarden/cli@2026.4.0 — the official command-line interface for the Bitwarden password manager — was found compromised on npm. A malicious preinstall hook silently bootstraps the Bun JavaScript runtime and launches a 9.7 MB obfuscated credential stealer that targets developer secrets, GitHub Actions environments, and — explicitly — AI coding tool configurations including ~/.claude ...
Bitwarden CLI Compromised: Inside the Shai-Hulud Supply Chain ...
The Shai-Hulud worm is back on NPM, this time targeting the @bitwarden/cli package. It extracts keys, credentials, and cloud configurations, then uploads them encrypted to public GitHub repositories. The string “Shai-Hulud: The Third Coming” is embedded in the bitwarden/cli package, indicating this is likely the next phase of the Shai-Hulud ...
The Bitwarden CLI Just Got Backdoored. Here's What the Supply ...
The Bitwarden compromise isn't an isolated incident; it's the latest iteration of a campaign that is actively refining its technique against high-trust developer tooling. And the MCP angle is worth flagging: the malicious bw1.js payload shares core infrastructure with the previously analyzed mcpAddon.js, including an identical C2 endpoint.
Bitwarden CLI Compromise Linked to Ongoing Checkmarx Supply ...
The compromise of a version of Bitwarden's CLI is connected to the ongoing Checkmarx supply chain campaign, but differences in the operational methods of both incidents are making it difficult to security researchers to attribute it to a particular threat actor. TeamPCP claimed responsibility for the Checkmarx attack last month, but the hackers behind the Shai-Hulud worm may be responsible.
|
