Bitwarden CLI was compromised as part of an ongoing Checkmarx-related supply chain attack

submitted by
[deleted]
edited

https://alternativeto.net/news/2026/4/bitwarden-cli-was-compromised-as-part-of-an-ongoing-checkmarx-related-supply-chain-attack/

Link to the bitwarden post https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127

16
79

Log in to comment

Hot Top New Old

Can npm just disable the post install script feature at this point jfc, or put a ton of hurdles to jump over in order to use it just to make sure that this is always 100% meant to be there

 reply
10
edited

Did you share a link to the source? When I click on it, it behaves like a picture.

 reply
8

that’s because it is a picture. they didn’t link a source.

 reply
12
[deleted]
OP edited

Deleted by author

 reply
3
edited

Same here, using the default web interface, but this bug seems to happen sometimes on Lemmy: half the people see a link and the other half just an image. OP probably did post a link.

 reply
5

Damn.

I’ll stick with my keepass + syncthing combo

 reply
6

This was a supply chain attack, everything is vulnerable to this type of attack.

 reply
20
edited

For a small window of time if you downloaded an update it had malware. It also looks like a lot of those downloads were bot downloads. There is no evidence that vaults have been compromised.

In a post on X, JFrog said the rogue version of the package “steals GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets, then exfiltrates the data to private domains and as GitHub commits.”

 reply
9

Of what app? Keepass? Was from the Debian repos. Syncthing what’s from the syncthing repos

 reply
-2

Of Bitwarden.

 reply
7

I don’t use it. That’s the point.

 reply
-12
edited

That doesn’t make you safe from supply chain attacks generally. There’s no reason a supply chain attack couldn’t be applied to software repos you do use if a vulnerability exists within them and a bad actor is sufficiently motivated to exploit it.

 reply
18

Oh definitely. Not saying it’s impossible

But here it would be arguably harder. Need to first get in the repos, and requires the user to log in to the password vault. Syncthing is easier to compromise, but good luck decrypting the vault

 reply
-7
edited

this is why i’m so wary of switching to password managers despite them being so practical.

 reply
1
Insert image