Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Bitwarden CLI v2026.4.0 was compromised via a malicious GitHub Action injection, distributing malware on npm for 1.5 hours on April 22. The malware exfiltrates developer secrets, GitHub tokens, SSH keys, and cloud credentials to attacker infrastructure. Any developer who installed this version during the window has potentially compromised credentials in active threat actor hands.