Bitwarden CLI Supply-Chain Attack Exposed Developer Secrets

Summary

Security Now examines a malicious Bitwarden CLI package that targeted developer secrets, discusses email tracking and code signing, and previews research into the historical fast16.sys malware.

Key points

• A malicious Bitwarden CLI version 2026.4.0 was distributed through npm for approximately 93 minutes on April 22, 2026.
• Researchers reported that the package used a pre-install hook to steal developer and cloud secrets, exfiltrating data to an impersonation domain or a fallback GitHub repository.
• Stolen GitHub tokens could be used to inject malicious workflows and extract CI/CD secrets, according to the researchers cited.
• Bitwarden said it revoked compromised access and deprecated the release. Its investigation found no evidence that vault data or production systems were compromised.
• The hosts discussed code-signing options for open-source developers and the privacy implications of automatically loading email tracking pixels.
• The episode introduces historical fast16.sys malware, but the supplied transcript omits much of the detailed discussion.

Indicators of compromise

MITRE ATT&CK

People

Vendors

Related Articles

• Blue October Roundup, Upwind’s $400M Raise and AI Audit-Trail Book Launchcybersecuritypulse.netT1195.002
• GhostAction Workflows Were Blocked, but Nearly 1,800 Accounts Remain Compromiseddarkreading.comT1195.002
• ESET Report Tracks APT Activity and AI Use From April to September 2026welivesecurity.comT1195.002
• Why Identity Blast Radius Matters More Than CVSS After PHP2Shellbleepingcomputer.comT1195.002
• Leaked LiteLLM Key Enabled GitHub Token Theft and Malicious Package Releasethehackernews.comT1195.002