cyber.hendryadrian.com
Cyber Attack & Data Breach · thehackernews.com

Bitwarden Confirms Malicious CLI Release in Checkmarx Supply-Chain Campaign

· Original article ↗

Summary

Bitwarden confirmed a brief compromise of its npm CLI release, @bitwarden/[email protected], containing a preinstall credential stealer. Researchers linked it to the Checkmarx campaign; Bitwarden found no evidence vault data or production systems were compromised.

Key points

  • The @bitwarden/[email protected] npm package was briefly distributed on April 22, 2026, with a malicious file, bw1.js, executed through a preinstall hook.
  • JFrog and Socket reported that the malware targeted developer files, CI environments, GitHub tokens, cloud secrets, and AI coding tool configurations.
  • Researchers said stolen data was encrypted with AES-256-GCM and sent to audit.checkmarx[.]cx, with GitHub repositories used as a fallback.
  • The reported malware could use stolen GitHub tokens to inject malicious Actions workflows and capture secrets available to workflow runs.
  • Bitwarden confirmed its npm distribution mechanism was affected, but said it found no evidence that end-user vault data, production data, or production systems were compromised.
  • Bitwarden said it revoked compromised access, deprecated the release, and began remediation. It reported that users who did not download the package during the brief distribution window were unaffected.
  • TeamPCP involvement is suspected, while researchers noted that shared tooling and differing operational signatures complicate attribution. Bitwarden said a CVE for the affected CLI version is being issued.

Article Details

Victim Organization
Bitwarden
Incident Type
Supply-chain compromise involving a malicious Bitwarden CLI npm package that executed a credential stealer and was designed to exfiltrate secrets.
Incident Date
2026-04-22
Data Types Exposed
  • Developer and CI/CD secrets
  • GitHub and npm tokens
  • SSH keys and environment-file contents
  • Shell history
  • Cloud secrets
  • AI coding tool configuration data
Affected Records
Unknown
Affected Data Size
Unknown
Operational Impact
The malicious @bitwarden/[email protected] package was distributed through npm from 5:57 PM to 7:30 PM ET. Bitwarden says it contained and deprecated the release, revoked compromised access, and found no evidence that end-user vault data, production data, or production systems were accessed or compromised. Researchers describe credential theft and possible GitHub Actions workflow injection, but the article does not establish how many systems or accounts were affected.
Ransom Or Extortion
Unknown
Claim Status
confirmed

Indicators of compromise

TypeIndicatorContext
DOMAINaudit[.]checkmarx[.]cxDomain identified as the primary exfiltration destination for secrets collected by the malicious Bitwarden CLI package; described as impersonating Checkmarx.

MITRE ATT&CK

T1059.007 · JavaScriptThe malicious bw1.js JavaScript file was executed through an npm preinstall hook.T1195.002 · Compromise Software Supply ChainThe incident involved a malicious package distributed through Bitwarden’s npm release path, following a reported compromise of its CI/CD publishing mechanism.T1552.001 · Credentials In FilesThe credential stealer targeted secrets in local files, including .env files.T1567.001 · Exfiltration to Code RepositoryThe article says collected data could be exfiltrated to public GitHub repositories or as GitHub commits.

People

Adnan KhanIdentified as a security researcher who said the threat actor used a malicious workflow to publish the malicious Bitwarden CLI package.Moshe Siman Tov BustanSecurity Research Team Lead at OX Security who discussed the risks of credentials being publicly exfiltrated to GitHub.

Threat Actors

TeamPCPThe article says TeamPCP is suspected of being behind the latest attack targeting Checkmarx, to which the Bitwarden incident is linked. The attribution is not confirmed; the article also reports that researchers noted operational differences that complicate attribution.

Vendors

BitwardenBitwarden’s CLI npm package (@bitwarden/[email protected]) was briefly distributed with a malicious file (bw1.js) that used a preinstall hook to steal developer, CI, GitHub and cloud secrets and exfiltrate them to

Products

Bitwarden CLIBitwarden CLI has been compromised as part of the newly discovered and ongoing Checkmarx supply chain campaign, according to new findings from JFrog and Socket.GitHubbriefly distributed with a malicious file (bw1.js) that used a preinstall hook to steal developer, CI, GitHub and cloud secrets and exfiltrate them to audit.checkmarx[.]cx and fallback GitHub repositories.GitHub ActionsCompromised GitHub tokens were weaponized to inject malicious GitHub Actions workflows, enabling persistent CI/CD pipeline access and downstream package publishing.npmBitwarden’s CLI npm package (@bitwarden/[email protected]) was briefly distributed with a malicious file (bw1.js) that used a preinstall hook to steal developer, CI, GitHub and cloud secrets and exfiltrate them to

Related Articles