Bitwarden CLI Supply Chain Attack
On April 23rd, security researchers at Checkmarx disclosed that the Bitwarden CLI had been compromised as part of an ongoing supply chain campaign. The attack follows a pattern that has become grimly familiar in the open-source ecosystem: a malicious package inserted into the dependency chain, positioned to execute when developers install or update tooling they trust. Bitwarden, the widely-used open-source password manager, carries particular weight here — its CLI is the kind of tool that lives in developer automation scripts, CI/CD pipelines, and infrastructure provisioning workflows. The Checkmarx researchers characterised this as an "ongoing" campaign, which is the word that should be making security teams nervous right now, because it implies the threat isn't contained to a single incident.
If confirmed, here is what this means. Any developer or organisation running Bitwarden CLI as part of an automated workflow has potentially handed an attacker privileged access to secrets management at the infrastructure level. That is not a vulnerability in the traditional sense — it is a trust inversion. You asked your password manager to protect your credentials, and the mechanism of that protection became the attack surface. The second-order effects ripple outward: organisations using Bitwarden CLI in pipelines may have exposed API keys, cloud credentials, and database passwords during the window of compromise. Vibe coding culture — where developers move fast, pull packages liberally, and automate everything — amplifies this risk considerably. The tools that accelerate development are exactly the tools that supply chain attackers target, because the blast radius is proportional to how embedded the package is.
Watch for Bitwarden's official incident response timeline and whether Checkmarx identifies additional packages in the same campaign — if this is truly ongoing, the Bitwarden CLI may be one node in a larger operation that hasn't fully surfaced yet.
The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other
Security firms find themselves especially exposed.
<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.
<a href="https://news.ycombinator.com/item?id=47582220">Comments</a>
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →