Manipulated Bitwarden CLI version distributed via NPM
A serious security incident has affected users of the Bitwarden command-line client. Between 23:57 on 22 April and 01:30 on 23 April German time, the npm package @bitwarden/cli was delivered in version 2026.4.0 containing malicious code. This manipulated version systematically stole the credentials of users who installed the package via NPM during this window.
Bitwarden emphasises, however, that end users' data stored in the actual password safe (vault data) was not affected. The company's security team was able to identify and contain the manipulated package. Distribution took place exclusively via NPM - anyone who did not obtain the package through this channel is not affected by the attack.
Part of a larger attack on the Checkmarx supply chain
The incident is connected to a broader attack on the Checkmarx supply chain. The compromised version 2026.4.0 has since been marked as deprecated and the misused access has been revoked. Security researchers at JFrog and Socket.dev have analysed the malware in detail, uncovering sophisticated attack mechanisms.
Technical details of the attack
The manipulated package.json contained a preinstall script that automatically executed a loader file named bw_setup.js during the installation process. This downloaded the Bun runtime in version 1.3.13 from GitHub and started an obfuscated JavaScript payload named bw1.js.
The malicious code targeted a broad spectrum of sensitive data and systematically collected:
- GitHub and npm tokens
- SSH keys
- Shell histories
- Credentials for AWS, Google Cloud and Azure
- GitHub Actions secrets
- Git credentials
- .env files
- Configuration files from AI tools such as Claude and MCP
Sophisticated exfiltration mechanisms
The stolen data was primarily transmitted in encrypted form to the address audit.checkmarx.cx (IP: 94.154.172.43). As a fallback mechanism, the malware used a particularly sophisticated approach: stolen GitHub tokens were validated in order to create repositories for data exfiltration under the victim's account.
In doing so, the attackers hid double-Base64-encoded personal access tokens (PATs) in commit messages with the characteristic marker "LongLiveTheResistanceAgainstMachines". This method demonstrates the high level of professionalism behind the attack and the sophisticated approach of the cybercriminals.
Significance for the security industry
This incident illustrates the growing risks in the software supply chain and shows how even trusted tools such as the Bitwarden CLI can become the target of supply chain attacks. For companies and security managers, the attack underlines the need to remain vigilant even with established security tools.
The fact that the attackers specifically targeted developer credentials and cloud access data makes clear how valuable this information is to cybercriminals. With stolen GitHub tokens, AWS keys and SSH credentials, attackers can cause far-reaching damage in corporate infrastructures.
Immediate countermeasures for those affected
Users who installed version 2026.4.0 during the stated window must act immediately. Bitwarden recommends the following steps:
Technical clean-up
- Uninstall using the command: npm uninstall -g @bitwarden/cli
- Clear the npm cache
- Search for the artefacts bw_setup.js, bw1.js and the downloaded Bun runtime
- Block the domain audit.checkmarx.cx and IP 94.154.172.43 in firewalls
Credential rotation
It is particularly important to immediately rotate all credentials that were stored on the compromised system:
- GitHub personal access tokens
- npm tokens
- AWS access keys
- Azure and Google Cloud Platform secrets
- SSH keys
In addition, administrators should check GitHub Actions workflows for unauthorised runs and investigate suspicious repository activity.
Preventive measures and outlook
This incident highlights the importance of comprehensive security strategies. Companies should regularly review their dependencies on NPM packages and implement monitoring systems that detect unusual network activity. Using package lock files and verifying checksums can provide additional protection.
All repositories are currently delivering the regular version 2026.3.0 again. According to the manufacturer, this and all other versions of the Bitwarden CLI apart from 2026.4.0 are not affected. Bitwarden assures that production systems and vault data were at no point compromised.
For the security industry, this incident underlines the need to treat supply chain security as an integral part of the cybersecurity strategy. The professionalism of the attack and the sophisticated exfiltration mechanisms show that the utmost vigilance is required even in trusted ecosystems such as NPM.
