Bitwarden NPM Package Hit in Supply Chain Attack

Summary

Version 2026.4.0 of the Bitwarden CLI NPM package was compromised with malicious code designed to steal credentials and secrets from Azure, AWS, GitHub, GCP, NPM, and SSH systems. The attack is linked to recent Checkmarx supply chain incidents claimed by TeamPCP, though the Bitwarden payload contains references to the Shai-Hulud worm campaign, complicating attribution. Bitwarden confirmed the breach but stated that end-user vault data and production systems were not compromised.

Full text

The Bitwarden command-line interface (CLI) NPM package was compromised in a supply chain attack that appears tied to previous campaigns against the open source software (OSS) ecosystem. One of the most popular open source password management platforms, with over 250,000 monthly downloads, Bitwarden allows enterprises to secure authentication with zero-knowledge encryption, password sharing, and policy and credential management. On Thursday, multiple security firms warned that version 2026.4.0 of the Bitwarden CLI’s NPM package contained malicious code to fetch a JavaScript payload designed to steal credentials and secrets from victim machines. The malicious package contained an altered execution path to run a malicious loader, download a Bun archive from GitHub, extract it, and execute the JavaScript payload. The malware contains three collectors targeting secrets and tokens across Azure, AWS, GitHub, GCP, and NPM, as well as SSH material, shell history, and AI tooling configuration and MCP-related files, JFrog explains. Additionally, the payload weaponizes the identified GitHub tokens and abuses GitHub Actions to create repositories in the victims’ accounts, create branches, commit workflow files, and download the resulting artifacts to extract more secret material.Advertisement. Scroll to continue reading. The malware attempts to exfiltrate the collected data via HTTPS but switches to GitHub paths if that fails. “The most notable aspect of this package is that it combines a supply chain compromise of a legitimate CLI identity with a broad post-install secret theft framework. Instead of stopping at .npmrc or a single PAT, the malware systematically pivots across local credentials, CI secrets, GitHub repositories, and multiple cloud secret stores,” JFrog notes. Bitwarden confirmed the supply chain hack, but noted that its investigation “found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised”. The Checkmarx attack The Bitwarden CLI compromise is linked to the recent supply chain attack on Checkmarx, which hit the company’s public DockerHub KICS image, public ast-github-action, VS Code extension, and Developer Assist extension. On April 22, Checkmarx confirmed the incident, sharing details on the malicious artifacts associated with the attack and urging users to immediately rotate secrets and credentials if they were affected. The malware used in the attack was designed to harvest credentials and exfiltrate them to the checkmarx[.]cx domain, or to repositories created under the victim’s GitHub account, a pattern used in the Bitwarden supply chain attack as well. Socket’s analysis of the two incidents also revealed the use of the same embedded payload structure, credential harvesting method, propagation technique, and Russian locale kill switch. “The shared tooling strongly suggests a connection to the same malware ecosystem, but the operational signatures differ in ways that complicate attribution,” Socket notes. The TeamPCP and Shai-Hulud connections The complication, the cybersecurity firm explains, comes from the fact that the Checkmarx attack was claimed by TeamPCP, while the Bitwarden incident references the Shai-Hulud worm that crawled through NPM last year. Also known as DeadCatx3, PCPcat, and ShellForce, TeamPCP is a hacking group active since at least 2024 that has been focusing on supply chain attacks for the past year. The hacking group made headlines over the past month after it compromised Aqua Security’s Trivy vulnerability scanner to steal secrets and pivot across the OSS ecosystem and beyond. As Socket notes, TeamPCP apparently claimed responsibility for the Checkmarx incident on social media, which did not come as a surprise, as it had hit the company’s GitHub Actions and OpenVSX plugins as part of the March campaign. However, the Bitwarden payload contains the “Shai-Hulud: The Third Coming” string, suggesting that the incident represents the latest phase of the previous campaign, OX Security says. Terms such as atreides, fremen, sandworm, and sardaukar were also found in the code, which points to a possible overlap with the Shai-Hulud campaigns, but it does not definitely link TeamPCP to the previous attacks, JFrog notes. Shai-Hulud first emerged in the NPM registry in September, when it spread to more than 180 packages using stolen developer credentials. During a second wave in November, it infected over 640 packages. “User data is being publicly exfiltrated to GitHub, often going undetected because security tools typically don’t flag data being sent there. This makes the risk significantly more dangerous: anyone searching GitHub can potentially find and access those credentials. At that point, sensitive data is no longer in the hands of a single threat actor; it’s exposed to anyone,” said OX Security team lead Moshe Ben Siman Tov. Related: Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data Related: ‘By Design’ Flaw in MCP Could Enable Widespread AI Supply Chain Attacks Related: OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack Related: European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Apple Patches iOS Flaw Allowing Recovery of Deleted ChatsRecent Microsoft Defender Vulnerability Exploited as Zero-DayNew Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention Mirai Botnet Targets Flaw in Discontinued D-Link RoutersNorth Korean Hackers Use AppleScript, ClickFix in Fresh macOS AttacksOracle Patches 450 Vulnerabilities With April 2026 CPUDozens of Malicious Crypto Apps Land in Apple App StoreProgress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMaster Latest News Vulnerabilities Patched in CrowdStrike, Tenable ProductsCopperhelm Raises $7 Million for Agentic Cloud Security PlatformCloudsmith Raises $72 Million in Series C FundingChinese Cybersecurity Firm’s AI Hacking Claims Draw Comparisons to Claude MythosRilian Raises $17.5 Million for AI-Native Security OrchestrationThe Behavioral Shift: Why Trusted Relationships Are the Newest Attack SurfaceLuxury Cosmetics Giant Rituals Discloses Data BreachAI Can Autonomously Hack Cloud Systems With Minimal Oversight: Researchers Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental.

Indicators of Compromise

• domain — checkmarx.cx
• malware — Shai-Hulud
• malware — TeamPCP

Entities