Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

The Bitwarden CLI package for npm has been compromised as part of an ongoing Checkmarx supply chain attack. The confirmed scope of impact is currently limited to @bitwarden/cli 2026.4.0 builds.

The malicious code in question, bw1.js, uses the same infrastructure and obfuscation techniques observed in other payloads from the Checkmarx campaign. It uses audit.checkmarx[.]cx/v1/telemetry as its C2, and also shows signs linking it to GitHub Actions compromise.

The scope of data collection is very broad.

• GitHub tokens
• AWS, Azure, GCP credentials
• .npmrc, SSH keys, environment variables
• Claude/MCP configuration files

The stolen information can lead to creation of public GitHub repositories and commits, further spread via redistribution using npm tokens, and workflow injection. Some payloads even achieve persistence by modifying ~/.bashrc and ~/.zshrc.

Technically, the analysis found a Python script that scrapes Runner.Worker memory in GitHub Actions, a setup.mjs loader for redistribution, workflow YAML, and a hardcoded RSA public key, among other components. It also contains a kill switch that silently exits if the system locale starts with ru.

Organizations using Bitwarden CLI should treat this incident as involving both credential exposure and CI/CD compromise. They should remove the package from developer and build environments, and rotate any potentially exposed GitHub tokens, npm tokens, cloud credentials, SSH keys, and CI/CD secrets.

Specific things to check include:

• Unexpected changes to .github/workflows/
• Abnormal workflow runs and artifact downloads
• Outbound connections to audit[.]checkmarx[.]cx
• Evidence of Bun execution
• Access traces on .npmrc, .git-credentials, .env
• Modifications to /tmp/tmp.987654321.lock, ~/.bashrc, ~/.zshrc