Bitwarden CLI npm distribution compromised, malicious version released
SpilloverSpillover from the Checkmarx incident · View original incident →The npm distribution channel for the Bitwarden CLI was compromised, and a malicious version, 2026.4.0, was briefly distributed. The version included functionality to steal developer credentials and infect additional packages. Bitwarden confirmed the incident was linked to a compromise of Checkmarx-related developer tools and said there was no evidence that password vault data had been compromised.
Key facts
- Affected organisation
- Bitwarden
- Original incident
- Tampered Checkmarx developer tools distribute info-stealing malware
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Malicious version 2026.4.0 briefly distributed
- Cause / method
- Insertion of credential-stealing and package-infecting functionality via a compromised npm distribution channel
- Location
- United States
Timeline
- The distribution of a malicious version of the Bitwarden CLI was reported, and the company stated it was linked to the Checkmarx-related compromise and that there was no evidence of password vault data being compromised.
Original incident
This is spillover from the Checkmarx incident.
Tampered Checkmarx developer tools distribute info-stealing malware
Impact: Data theft and distribution of malicious versions of developer tools
Checkmarx KICS Docker images and VS Code and Open VSX extensions were tampered with to distribute malware that collects secrets from development environments. The attack code was designed to steal cloud credentials, GitHub and npm tokens, SSH keys and more, and the company confirmed that data had been stolen. Malicious versions were later also distributed for the Jenkins AST plug-in, and the company advised users to use safe versions and released a new plug-in.
Related reports: 4 · last report →
1 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.