On Apr. 22, a malicious version of Bitwarden’s command-line interface appeared on npm under the official package name @bitwarden/cli@2026.4.0. For 93 minutes, anyone who pulled the CLI through npm received a backdoored substitute for the legitimate tool.
Bitwarden detected the compromise, removed the package, and issued a statement saying it found no evidence that attackers accessed end-user vault data or compromised production systems.
Security research firm JFrog analyzed the malicious payload and found it had no particular interest in Bitwarden vaults. It targeted GitHub tokens, npm tokens, SSH keys, shell history, AWS credentials, GCP credentials, Azure credentials, GitHub Actions secrets, and AI tooling configuration files.
These are credentials that govern how teams build, deploy, and reach their infrastructure.
Targeted secret / data type
Where it usually lives
Why it matters operationally
GitHub tokens
Developer laptops, local config, CI environments
Can enable repo acce
We współpracy z: https://cryptoslate.com/for-93-minutes-installing-bitwardens-official-cli-turned-laptops-into-launchpads-for-hijacking-github-accounts/
