Skip to content

Bitwarden CLI compromise

Named by 2 kept items in this workspace.

Search every workspace for Bitwarden CLI compromise. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Control Which Package Registries Your CI Jobs and Developer Machines Use
    article2026-08-12It is written here as @bitwarden/cli compromise.

    A republished @bitwarden/cli ran a credential stealer on the developer machine that did the install, harvested SSH keys, cloud credentials, and GitHub tokens, then used those tokens to inject malicious workflows into CI

  • VSCode Lifecycle Script Malware
    writeup2026-05-16

    Threat actors compromised Bitwarden CLI with a preinstall hook (bw_setup.js) fetching the Bun runtime from a legitimate GitHub endpoint, then running bw1.js, an obfuscated infostealer targeting AWS, GCP, Azure, and GitHub credentials, exfiltrating to a Checkmarx lookalike domain audit.checkmarx.cx

All threat actors in this workspace.