Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Bitwarden CLI version 2026.4.0 was compromised in a supply chain attack attributed to the Checkmarx campaign, where malicious code was injected through a compromised GitHub Action.

• •The malware executes via a preinstall hook and steals developer secrets including GitHub/npm tokens, SSH keys, .env files, shell history, and cloud credentials.
• •Stolen data is encrypted with AES-256-GCM and exfiltrated to audit.checkmarx[.]cx, with GitHub commits as a fallback mechanism.
• •The malicious package weaponizes stolen GitHub tokens to inject malicious Actions workflows into repositories and extract CI/CD secrets.
• •The threat actor is believed to be TeamPCP and used NPM trusted publishing to compromise the package, marking the first known case of this attack vector.

This summary was automatically generated by AI based on the original article and may not be fully accurate.