Malicious Bitwarden CLI Release Steals Cloud Credentials, Researchers Say

Summary

The episode examines a malicious Bitwarden CLI release, npm lifecycle-script risks, OWASP guidance, and reports of AI-assisted malware adapted across package ecosystems. The speakers say the Bitwarden version was removed and question the attackers’ Shai-Hulud claim.

Key points

The speakers describe Bitwarden CLI version 2026.4.0 as a malicious release that ran through an npm pre-install script; they say it was removed after being available for about 14 hours.
They say the malware targeted developer workstations and CI runners, harvesting credentials and configuration data associated with AWS, Azure, GCP, GitHub, and Claude.
The episode describes exfiltration to a lookalike Checkmarx domain, checkmarx[.]cx. The speakers say the attackers’ claimed connection to Shai-Hulud was not supported by researchers they trusted.
The speakers discuss how npm lifecycle scripts can run automatically during installation, contrasting npm’s default behavior with package managers where scripts are off by default.
They review OWASP npm security recommendations, including lock files, limiting install scripts, artifact governance, and protections against dependency confusion and typosquatting.
The speakers report finding malicious packages targeting the same users across multiple ecosystems within an eight-hour period, and say generative AI helped adapt existing malware between programming languages.

Article Details

Event Type: Software supply-chain compromise involving a malicious Bitwarden CLI npm package release
Impact: The malicious Bitwarden CLI version 2026.4.0 reportedly ran a pre-install script that installed and executed an infostealer, harvesting credentials and environment data from developer workstations and CI runners, including credentials associated with AWS, Azure, GCP, and GitHub. The package was available for about 14 hours before it was taken down. A speaker said that, as of their latest check, three people had been compromised and GitHub credentials and other data had been publicly exfiltrated; the extent of broader impact was not established.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`checkmarx[.]cx`	Lookalike Checkmarx domain identified as an exfiltration destination for data stolen by the malicious package.
HOSTNAME	`audit[.]checkmarx[.]cx`	Domain shown in the threat graph for the Bitwarden CLI compromise and associated with the reported malicious infrastructure.