Malicious Bitwarden CLI npm Release Targets Developer Credentials and GitHub Actions

Summary

StepSecurity reports that attackers used a compromised Bitwarden engineer account to publish a malicious @bitwarden/[email protected] release, whose Bun-staged payload targets developer credentials, AI-tool configs and GitHub Actions secrets.

Key points

StepSecurity reports that an attacker compromised a Bitwarden engineer’s GitHub account, altered the publishing workflow, and used OIDC to obtain an npm token and publish a staged tarball.
The @bitwarden/[email protected] package added a preinstall hook that downloads Bun and launches a 9.7 MB obfuscated credential stealer.
The payload targets SSH keys, npm and GitHub tokens, AWS and GCP credentials, shell history, environment variables, and AI-tool configuration files, including Claude Code and MCP settings.
StepSecurity says the payload encrypts stolen data and sends it to audit[.]checkmarx[.]cx, with GitHub-based fallback channels also described.
The malware can use discovered GitHub tokens to enumerate accessible repositories and Actions secrets, then inject workflows and retrieve prior workflow artifacts.
In a controlled test, StepSecurity reports that Harden Runner blocked the primary outbound connection; its remediation guidance includes rotating exposed credentials and auditing accessible repositories and workflows.

Article Details

Attack Vectors: An attacker who compromised a Bitwarden engineer's GitHub account altered the repository's publish workflow and used GitHub Actions OIDC Trusted Publishing to publish a staged malicious @bitwarden/[email protected] package to npm.
The package's preinstall hook downloaded the Bun runtime and silently executed an obfuscated credential-stealing payload.
The payload collected developer and CI/CD credentials, including SSH keys, npm and GitHub tokens, AWS and GCP credentials, shell history, environment variables, and AI-tool configuration data.
The malware exfiltrated encrypted data to a primary C2 endpoint and described GitHub-based fallback channels, including creating repositories to store encrypted results.
Using stolen GitHub tokens, the malware enumerated accessible repositories and Actions secrets, then created branches and injected malicious workflow files.
Defensive Notes: Remove @bitwarden/[email protected], install the reported safe version 2026.3.0, and verify that bw_setup.js and bw1.js are absent.
Rotate credentials accessible to affected machines and CI/CD pipelines, including GitHub and npm tokens, SSH keys, AWS and GCP credentials, environment secrets, and AI-tool API keys.
Audit repositories accessible to affected accounts for unexpected branches, injected workflows, and repositories created by the malware; review CI/CD logs for installations of the compromised package.
Check network logs for connections to audit.checkmarx.cx and 94.154.172.43; the article says a confirmed connection means exfiltration occurred.
Use npm ci --ignore-scripts in CI/CD, pin exact dependency versions, and apply outbound network restrictions. The article reports that Harden Runner blocked the primary C2 connection in a controlled test.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`audit[.]checkmarx[.]cx`	Attacker-controlled primary C2 domain used for encrypted data exfiltration.
IPV4	`94[.]154[.]172[.]43`	IP address resolved for the attacker-controlled primary C2 domain.
SHA256	`18f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb`	SHA-256 hash of the malicious package loader, bw_setup.js.
SHA256	`8605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14`	SHA-256 hash of the malicious credential-stealing payload, bw1.js.
URL	`hxxps[:]//audit[.]checkmarx[.]cx/v1/telemetry`	Primary C2 endpoint identified for exfiltrating collected data.