🧰 Bitwarden CLI

The items that name it 8

• Dev Machine Guard Now Inventories Where Developer Credentials Live
  articleas classification.key entities2026-08-28
• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas affected products2026-08-12It is written here as @bitwarden/cli.

  npm package, republished version ran a credential stealer harvesting SSH keys, cloud credentials, and GitHub tokens

• The Bitwarden CLI Supply Chain Attack: What Happened and What to Do | Blog | Endor Labs
  writeupas classification.key entities2026-07-10
• Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm
  writeupas affected products2026-06-01It is written here as @bitwarden/cli.

  compromised via poisoned GitHub Actions workflow, April 22, 2026

• Socket: Mini Shai-Hulud
  articleas affected products2026-05-22

  Shipped with a credential-stealing payload on April 23 after CI workflow compromise

• Open Source Malware Podcast — episodes
  otheras affected products2026-05-22

  Compromise discussed in first episode

• VSCode Lifecycle Script Malware
  writeupas affected products2026-05-16
• Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign
  writeupas tools2026-05-06

  Open source password manager command-line interface, compromised npm package