If you're using the Bitwarden CLI package version 2026.4.0, stop what you're doing and rotate every credential on your system. A supply chain attack just compromised one of the most trusted tools in developer security.
According to security researchers at Socket, the npm package @bitwarden/cli was compromised as part of the ongoing Checkmarx supply chain campaign. The malicious code, hidden in a file called bw1.js, is a masterclass in credential theft. It targets GitHub tokens, npm access keys, AWS credentials, Azure secrets, GCP keys, SSH private keys, and even environment variables. If you had it on your system, assume it's gone.
What makes this particularly nasty is the scope. The malware can read GitHub Actions runner memory, meaning it could steal secrets from your CI/CD pipelines. It exfiltrates data through multiple channels, including posting to a command-and-control server at audit.checkmarx.cx and making commits to random public repositories with names like "atreides" and "fremen" - a bizarre Dune-themed obfuscation strategy.
But it doesn't stop there. The malware also establishes persistence by injecting itself into bash and zsh profile files, meaning it survives reboots and can continue stealing credentials even after you think you've cleaned your system. The lock file at /tmp/tmp.987654321.lock is one indicator, but by the time you spot it, the damage is done.
The broader context is that this is part of a campaign targeting the developer supply chain. Attackers compromised GitHub Actions within Bitwarden's CI/CD pipeline to inject the malicious code. It's the same playbook we've seen before: compromise a trusted package, let developers install it, and harvest credentials at scale.
What's particularly galling is that Bitwarden is a password manager. Developers use it specifically because they trust it to handle sensitive credentials. Compromising the CLI tool for that product is like poisoning the antidote. It undermines trust in the entire ecosystem.
To be clear: this is only the npm CLI package. The Bitwarden browser extensions, desktop apps, and mobile apps are not affected. But for developers who rely on the CLI for automating credential management in their workflows, this is catastrophic.
If you've used @bitwarden/cli 2026.4.0 in the last few days, here's what you need to do immediately:
1. Uninstall the compromised package. Run npm uninstall @bitwarden/cli and verify it's gone.
2. Rotate all credentials. GitHub tokens, npm tokens, cloud provider keys, SSH keys - everything. Assume it was stolen.
3. Check your shell profiles. Look at ~/.bashrc and ~/.zshrc for injected code. If you see anything you didn't put there, remove it.
4. Audit your repositories. Check for unauthorized commits, especially to public repos with Dune-themed names. The malware uses these for exfiltration.
5. Review CI/CD logs. If you're running the CLI in GitHub Actions or other automation, check for signs of credential access.
This is a reminder that supply chain security is only as strong as the weakest link. Bitwarden is a well-run company with competent security practices. But even they got compromised, which means no one is safe.
The technology we've built to manage credentials is impressive. The technology attackers have built to steal them is equally impressive. And right now, the attackers are winning. If you're a developer, assume your tools are compromised until proven otherwise. That's the world we live in now.
