GoKawiilSocket researchers discovered that the Bitwarden CLI was compromised as part of the ongoing Checkmarx supply chain campaign. The open source password manager serves more than 10 million users and over 50,000 businesses, and ranks among among the top three password managers by enterprise adoption.
The affected package version appears to be @bitwarden/cli2026.4.0 , and the malicious code was published in bw1.js , a file included in the package contents. The attack appears to have leveraged a compromised GitHub Action in Bitwarden’s CI/CD pipeline, consistent with the pattern seen across other affected repositories in this campaign.
What we know so far:
Bitwarden CLI builds were affected
The compromise follows the same GitHub Actions supply chain vector identified in the broader Checkmarx campaign
This is an ongoing investigation. Socket's security research team is conducting a full technical analysis and will publish detailed findings, including affected versions, indicators of compromise, and remediation guidance.
If you use Bitwarden CLI, we recommend reviewing your CI logs and rotating any secrets that may have been exposed to the compromised workflow. At this time, the compromise only involves only the npm package for the CLI. Bitwarden’s Chrome extension, MCP server, and other legitimate distributions have not been affected yet.
Technical analysis#
The malicious payload was in a file named bw1.js , which shares core infrastructure with the Checkmarx mcpAddon.js we analyzed yesterday:
Same C2 endpoint : Uses identical audit.checkmarx[.]cx/v1/telemetry endpoint, obfuscated via __decodeScrambled with seed 0x3039 . Exfiltration also occurs through GitHub API (commit-based) and npm registry (token theft/republishing)
... continue reading