On April 22, a malicious version of Bitwarden's official npm CLI package was active for 93 minutes, targeting GitHub tokens, cloud credentials, and CI/CD secrets rather than password vaults. The incident highlights escalating supply chain risks for crypto and developer infrastructure.
A malicious version of Bitwarden's official npm CLI package was active for 93 minutes on April 22, 2026, targeting infrastructure credentials like GitHub tokens and cloud keys. The incident highlights supply chain risks for crypto developers using CI/CD pipelines.
A malicious version of Bitwarden's official CLI was distributed on npm for 93 minutes, targeting GitHub tokens, cloud credentials, and CI/CD secrets. The attack, linked to the Checkmarx campaign, poses direct risks to crypto projects' deployment pipelines and asset security.
A malicious version of Bitwarden's CLI on npm for 93 minutes stole GitHub tokens and cloud credentials. The incident reveals trust crisis in software supply chain, especially for crypto projects relying on GitHub Actions. Analysts urge enhanced CI/CD security auditing.
On April 22, a malicious version of Bitwarden's official CLI (npm @bitwarden/cli@2026.4.0) was distributed for 93 minutes. The attacker exploited a compromised CI/CD pipeline to steal GitHub tokens, cloud credentials, and infrastructure secrets. The incident serves as a stark warning to crypto teams about supply chain risks.
On April 22, a malicious version of Bitwarden's official npm CLI package circulated for 93 minutes, installing backdoors that targeted GitHub tokens, cloud credentials, and other infrastructure secrets. The incident is linked to the Checkmarx supply chain campaign, highlighting the fragility of trust in official packages.
On Apr 22, 2026, Bitwarden's official npm CLI package was tampered with for 93 minutes, delivering malware that targeted GitHub tokens, cloud credentials, and other infrastructure secrets. The incident highlights compromised release workflows as a primary attack vector.
On April 22, a malicious version of Bitwarden's official npm CLI package @bitwarden/cli was active for 93 minutes, stealing infrastructure credentials like GitHub tokens and cloud keys. The incident highlights critical supply chain trust failures with direct implications for crypto and fintech sectors.
