TLDR Tech / InfoSec
Bitwarden Statement on Checkmarx Supply Chain Incident
A malicious @bitwarden/cli@2026.4.0 npm package, downloaded by 334 users between 5:57 and 7:30 PM ET on April 22, was contained within 93 minutes of the broader Checkmarx supply chain compromise, which propagated through a malicious Checkmarx VSCode extension on a Bitwarden engineer's workstation rather than a CI/CD dependency. The package's preinstall script triggered credential theft during installation alone, lifting tokens, SSH keys, and environment secrets, though analyses confirmed that vault data remained out of scope. Bitwarden issued a CVE, deprecated the package, shipped 2026.4.1, and directed impacted users to rotate exposed secrets, audit GitHub workflows and CI credentials, and clear npm caches with install scripts disabled during cleanup.
Read the full story