Bitwarden CLI Compromised in npm Supply Chain Attack — Rotate Credentials If You Installed v2026.4.0

Bitwarden’s npm publishing pipeline was compromised on April 22, 2026, for approximately 90 minutes — from 5:57 PM to 7:30 PM ET. During that window, attackers pushed a malicious version of @bitwarden/cli@2026.4.0 containing a self-propagating credential-theft worm they named “Shai-Hulud: The Third Coming.”

The malware is multi-stage and aggressive. It steals SSH keys, cloud provider secrets, and credentials stored by AI coding tools like Cursor and GitHub Copilot. It then spreads laterally by infecting the victim’s own npm packages — turning every compromised developer into a new distribution node. Stolen data is encrypted with AES-256-GCM and exfiltrated to audit.checkmarx[.]cx, a domain designed to impersonate the legitimate security firm Checkmarx.

What to do right now: If you installed @bitwarden/cli between 5:57 PM and 7:30 PM ET on April 22, assume full compromise. Rotate all SSH keys, API tokens, cloud credentials, and any secrets that were accessible on that machine. Check your own npm packages for unexpected modifications. Report any unusual npm publish activity to security@bitwarden.com.

The attack vector was Bitwarden’s GitHub Actions workflow publish-ci.yml in the clients repository. Attackers abused trusted CI publishing controls to bypass npm’s standard publishing auth — a technique that requires prior access to the repository’s secrets or the CI pipeline itself. Investigators believe this access was obtained during an earlier compromise linked to the same threat actor, which previously targeted a Docker Hub project and a VS Code extension with similar methods.

Bitwarden confirmed that no end-user vault data was accessed. The attack targeted the CLI distribution mechanism specifically, not Bitwarden’s servers or encrypted vault storage. The malicious package has been removed from npm and the pipeline has been locked down pending a full forensic review.

This is the latest in a string of high-profile supply chain attacks targeting the npm ecosystem. The “Shai-Hulud” malware family has been traced to Checkmarx threat intelligence, which identified the same actor behind at least two prior campaigns in 2026. The naming convention — self-referential, darkly theatrical — is a signature the group has used to taunt researchers.

The incident underscores a structural weakness in how trusted CI systems publish to open registries. Even with npm’s provenance attestation features, a compromised GitHub Actions secret is enough to inject malicious code under a legitimate package name with a valid signature chain.

Immediate actions:

• Check npm ls @bitwarden/cli — if you see 2026.4.0, you were exposed
• Rotate all credentials accessible from that environment
• Audit your own packages for unexpected new versions published around April 22
• Enable npm provenance verification and restrict which Actions workflows can publish

Bitwarden says a full post-mortem will be published within 72 hours.