Bitwarden CLI Compromised in Checkmarx Supply Chain Attack, Exposing Developer Secrets
Bitwarden CLI has been compromised as part of an ongoing supply chain attack orchestrated by Checkmarx, according to findings from JFrog and Socket. The attack involved a malicious version of the Bitwarden CLI package, specifically version @bitwarden/cli@2026.4.0, which was distributed through npm. The malicious code, embedded in a file named 'bw1.js', was executed via a preinstall hook, leading to the theft of sensitive data such as GitHub/npm tokens, .ssh, .env files, and shell history. This data was exfiltrated to a domain impersonating Checkmarx and a GitHub repository. The attack leveraged a compromised GitHub Action in Bitwarden's CI/CD pipeline, similar to other affected repositories in the campaign. The threat actor, suspected to be TeamPCP, used the stolen tokens to inject malicious workflows into repositories, potentially compromising CI/CD pipelines. Bitwarden confirmed the incident but stated that no end-user data was accessed. 
