Bitwarden CLI npm Package Compromised to Steal Developer Credentials

2026-04-24

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious npm package containing a credential stealer. The stealer attempted to steal a wide range of developer credentials, including npm tokens, GitHub tokens, SSH keys, and cloud credentials. Bitwarden confirmed that the attackers used a compromised Checkmarx GitHub Action and that Bitwarden itself was not compromised.