Bitwarden CLI npm Package Hijacked - Large-Scale Developer Credential Theft Attack Discovered

JFrog's security research team discovered a hijacked supply chain attack in @bitwarden/cli version 2026.4.0 on npm. While legitimate Bitwarden metadata and branding were preserved, only the preinstall script and the bw binary entrypoint were replaced with a malicious loader, bw_setup.js.

Upon installation, the loader first downloads the Bun runtime from GitHub, then executes an obfuscated JavaScript payload, bw1.js. The use of Bun instead of Node.js was analyzed as an evasion strategy to avoid detection.

The payload collects credentials through three vectors:

• Filesystem collector: ~/.ssh/, .git-credentials, ~/.npmrc, .env, ~/.aws/credentials, ~/.config/gcloud/credentials.db, etc.
• Shell/environment collector: runs gh auth token and scans process.env for GitHub/npm token patterns
• GitHub Actions collector: injects workflows into repositories with sufficient permissions to extract even Actions secrets

Notably, AI tool and MCP configuration files such as ~/.claude.json, ~/.claude/mcp.json, and ~/.kiro/settings/mcp.json were also included as collection targets.

Exfiltrated data is gzip-compressed and then encrypted using a hybrid AES-256-GCM + RSA-OAEP scheme.

• Primary path: HTTPS POST to audit.checkmarx.cx/v1/telemetry
• Secondary path: if the primary path fails, the malware searches GitHub commit messages for a LongLiveTheResistanceAgainstMachines marker and a double-Base64-encoded PAT, recovers a fallback domain via a beautifulcastle marker and RSA signature verification, then creates a new repo on the victim's account and uploads to a results/ directory

Infection can be suspected from the mismatch between the 2026.4.0 designation at the package root and the 2026.3.0 version found in the internal legitimate Bitwarden CLI metadata.

If this version was installed, you should assume that all credentials on that host have been compromised and respond accordingly.

• npm uninstall -g @bitwarden/cli and clear the cache
• Rotate all GitHub PATs, npm tokens, and AWS access keys
• Check Azure Key Vault / GCP Secret Manager audit logs
• Review GitHub Actions history for unauthorized runs
• Block audit.checkmarx.cx and 94.154.172.43
• Inspect AI tool configuration files (Claude, Kiro, etc.) for exposed sensitive information