Malicious Bitwarden CLI npm Package Stole Developer Credentials
Summary
Bitwarden confirmed attackers briefly published malicious @bitwarden/cli v2026.4.0 on npm, stealing developer and cloud credentials. Its investigation found no evidence of vault or production-data compromise; affected users should rotate exposed credentials.
Key points
- The malicious @bitwarden/cli v2026.4.0 was available on npm from 5:57 to 7:30 PM ET on April 22, 2026; the incident affected users who downloaded that version.
- Socket said attackers appear to have used a compromised GitHub Action in Bitwarden’s CI/CD pipeline to inject the malicious code.
- A custom loader downloaded the Bun runtime and ran obfuscated bw1.js, which harvested npm and GitHub tokens, SSH keys, and AWS, Azure, and Google Cloud credentials.
- The malware encrypted collected data with AES-256-GCM and exfiltrated it through public GitHub repositories created under victims’ accounts.
- OX Security reported that the malware could use stolen npm credentials to inject malicious code into other packages the victim could modify.
- Bitwarden revoked compromised access and deprecated the release. The company said it found no evidence that vault data, production data, or production systems were compromised; affected users should rotate exposed credentials.
Article Details
- Victim Organization
- Bitwarden
- Incident Type
- Software supply chain compromise of the Bitwarden CLI npm package to steal developer credentials and potentially spread to other packages.
- Incident Date
- 2026-04-22
- Data Types Exposed
- npm tokens
- GitHub authentication tokens
- SSH keys
- AWS credentials
- Azure credentials
- Google Cloud credentials
- Operational Impact
- The malicious @bitwarden/cli v2026.4.0 release was available on npm from 5:57 PM to 7:30 PM ET and affected users who downloaded it. Bitwarden revoked compromised access and deprecated the release. Bitwarden reported no evidence that end-user vault data, production data, or production systems were compromised.
- Claim Status
- confirmed
MITRE ATT&CK
T1059.007 · JavaScriptThe loader used Bun to execute the obfuscated JavaScript credential-stealing payload.T1105 · Ingress Tool TransferThe loader downloaded the Bun runtime when it was not present.T1195.002 · Compromise Software Supply ChainAccording to Socket, a compromised GitHub Action in Bitwarden's CI/CD pipeline was used to inject malicious code into the CLI npm package.T1567.001 · Exfiltration to Code RepositoryThe malware reportedly exfiltrated encrypted stolen data by creating public GitHub repositories under victims' accounts.
Threat Actors
Vendors
Products
Bitwarden CLIThe Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.BunThe loader fetched the Bun runtime to execute an obfuscated bw1.js that harvested npm tokens, GitHub auth tokens, SSH keys, and cloud credentials and exfiltrated encrypted data via public GitHub repositories.GitHubThe loader fetched the Bun runtime to execute an obfuscated bw1.js that harvested npm tokens, GitHub auth tokens, SSH keys, and cloud credentials and exfiltrated encrypted data via public GitHub repositories.npmBitwarden’s CLI npm package was briefly compromised on April 22, 2026 when attackers published a malicious @bitwarden/cli v2026.4.0 containing a credential-stealing payload that could spread to other projects.