Threatwire Reports Bitwarden Supply-Chain Attack and Multiple Security Incidents

Summary

Threatwire reports a 90-minute Bitwarden NPM supply-chain attack targeting developer secrets, an Apple patch for retained deleted notifications, a Lovable project-data exposure, and an unconfirmed claim of unauthorized Cloud Mythos access.

Key points

A software supply-chain attack affected the Bitwarden version distributed via NPM for about 90 minutes on April 22, 2026.
The attack used a post-install secret-theft loader and an obfuscated JavaScript payload targeting developer workstations and CI environments.
Targeted information reportedly included GitHub and NPM tokens, SSH material, shell history, cloud secrets, GitHub Actions secrets, and AI tooling configuration files.
Apple released a patch for CVE-2026-28950, addressing a logging issue that could leave notifications marked for deletion retained on a device; the report says the iOS notification system had been used to retrieve Signal messages.
A researcher using a free Lovable account reportedly accessed other users’ source code and database credentials. Lovable said a backend regression had re-enabled access to some public-project chat history and source code, and it was rolling out fixes.
Anthropic had not confirmed claims that unauthorized users accessed Cloud Mythos, but said it was investigating.
A hacking-forum post claimed that 19 million citizen ID records were taken in a French government data breach; the transcript provides no independent confirmation.

Article Details

Topics: [00:13] Bitwarden NPM supply-chain attack and developer credential theft
[01:58] Apple patch for CVE-2026-28950 and retained notifications
[03:13] Lovable project-data exposure and remediation
[04:46] Unconfirmed claims of unauthorized Cloud Mythos access
[05:16] Forum-reported French government data breach

MITRE ATT&CK

T1059.007 · JavaScriptThe compromised package launched a large obfuscated JavaScript payload as part of the reported credential-theft operation.

Vendors

BitwardenThe Bitwarden version distributed through NPM was affected by a reported supply-chain attack that targeted developer and CI secrets.

Products

BitwardenThe NPM-distributed version was affected by a supply-chain attack that used a post-install loader and targeted developer credentials and secrets.