9 ms·
Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
- deleted 7mo ago[deleted]
- nozzlegear 7mo agoAnother day, another supply chain attack involving GitHub Actions.
- adityamwagh 7mo agoGitHub was down too! Its uptime has been so bad recently.
- righthand 7mo agoIt’s the new Npm
- palata 7mo agoDon't GitHub Actions actually use npm?
- dnnddidiej 7mo agoThe new Windows 98
- saghm 7mo agoThis one also involved npm to be fair
- sigmonsays 7mo agoIf I run the compromised CLI, do they get all my passwords?
- bhouston 7mo agoExactly, that could widen the blast radius of this particular compromise significantly.
- NeckBeardPrince 7mo agoRead the article
- rtaylorgarlock 7mo agokinda crazy to see this comment required in this particular context, yet here we are
- hgoel 7mo agoIt's an understandable question, the article reads like an AI generated mess.
- valicord 7mo agoWhere does it answer this question in the article?
- ErneX 7mo agoThe article explains what is extracted.
- valicord 7mo agoNo it doesn't?
- jeroenhd 7mo agoThe article waffles on forever and gives some generic advice. Meanwhile, Bitwarden themselves state that end users were almost never affected: https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che... You had to install the CLI through NPM at a very short time frame for it to be affected. If you did get infected, you have to assume all secrets on your computer were accessed and that any executable file you had write access to may be backdoored.
- kbolino 7mo agoNo, at least according to Bitwarden themselves: https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che...
- deleted 7mo ago[deleted]
- hurricanepootis 7mo agoThis doesn't affect the web extension, no?
- 1024kb 7mo agoI had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of the bw command was accessible from within the weechat text input field history. I have no idea how this happened, but it was quite terrifying. The issue persisted across tmux and weechat sessions, and only a reboot of the server would solve the problem. I promptly removed the bw cli programme after that, and I definitely won't be installing it again. I use ghostty if it matters.
- trinsic2 7mo agoWow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.
- 1024kb 7mo agoI don't know, I use a vanilla weechat setup
- harshreality 7mo agoIt's crazy because it's not default bw behavior, or even any bw behavior... I don't use the cli, but I don't see any built-in capacity to copy bw output to the clipboard. (In the UNIX way, you'd normally pipe it to a clipboard utility if you wanted it copied, and then the security consequences are on you.) They probably caused it themselves, somehow, and then blamed bitwarden. Note in the original comment they aren't even entirely sure what the command was, and they weren't familiar with it or they wouldn't have been surprised by its output... so how can they be sure what else they did between that command and the weechat thing? If the terminal or tmux fed terminal history into weechat, that's also not bw's problem.
- pprotas 7mo ago`bw list` shows plaintext credentials in the CLI https://bitwarden.com/help/cli/#list https://bitwarden.com/help/cli/#list I know this because I had the same surprised reaction
- hgoel 7mo agoDoes the CLI auto-update? Edit: The CLI itself apparently does not, which will have limited the damage a bit, but if it's installed as a snap, it might. Incidents like this should hopefully cause a rollback of this dumb system of forcefully and frequently updating people's software without explicit consent. Also the time range provided in https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che... can help with knowing if you were at risk. I only used the CLI once in the morning yesterday (ET), so I might not have been affected?
- zie 7mo agoI think you had to have installed the CLI during that time-frame, then ran the brand new installed CLI to be vulnerable. Assuming you had it already installed, you would be safe.
- iso1631 7mo agoI checked a machine this morning and it had updated itself at Apr 23 1715G I've purged the snap. Really should purge snapd completely.
- flossly 7mo agoNever used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.
- zerkten 7mo agoIntegration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.
- brightball 7mo agoThe problem is that the UX with a browser extension is so much better.
- tracker1 7mo agoI also find it far easier to resist accidentally entering credentials in a phishing site... I'm pretty good about checking, but it's something I tend to point out to family and friends to triple check if it doesn't auto suggest the right site.
- brightball 7mo agoExactly. Same principle of passkeys, Yubikeys and FIDO2. Much harder to phish because the domains have to match.
- Barbing 7mo agoI’m impressed with their feature to add the URL for next time, after manually filling on an unmatched URI. Hairs raised on neck clicking confirm though.
- 7mo ago
- rvz 7mo agoOnce again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries, that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838 https://news.ycombinator.com/item?id=47585838
- hrimfaxi 7mo ago> A password manager does not need a CLI tool. Why not? Even macos keychain supports cli.
- gear54rus 7mo agoThe above comment is just a bunch of generalizations not meant to address seriously that's why.
- rvz 7mo agoSo the comparison here is that you would rather trust a password manager with a CLI that imports hundreds of third-party dependencies over a first party password manager with a CLI that comes with the OS? I don't think macOS Keychain uses NPM and it isn't in TypeScript or Javascript and, yes it does not need a CLI either. The NPM and Java/Typescript ecosystem is part of the problem that encourages developers to import hundreds of third-party libraries, due to its weak standard library which it takes at least ONE transitive dependency to be compromised and it is game over.
- hgoel 7mo agoYou initially complained about CLIs, not the dependency mess of the JS ecosystem. You still have not said why this is an issue of having a CLI.
- rvz 7mo ago> You initially complained about CLIs, not the dependency mess of the JS ecosystem. I complained about both. What does this say from the start? >> Once again, it is in the NPM ecosystem. > You still have not said why this is an issue of having a CLI. Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. The breach itself if run in GitHub Actions would just make it a coveted target to compromise it which makes having one worse not better and for easier exfiltration. So it makes even more sense for a password manager to not need a CLI at all. This is even before me mentioning the NPM and the Javascript ecosystem.
- citizen4902 7mo agoBitwarden statement - https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che...
- hrimfaxi 7mo ago> The affected package version appears to be @bitwarden/cli2026.4.0, and the malicious code was published in bw1.js, a file included in the package contents. The attack appears to have leveraged a compromised GitHub Action in Bitwarden’s CI/CD pipeline, consistent with the pattern seen across other affected repositories in this campaign.
- mobeigi 7mo agoKeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.
- 1024kb 7mo agoI need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.
- piperswe 7mo agoSyncthing can synchronize Keepass files between devices quite well.
- jasonjayr 7mo agoI rely on this too, but counting down the days android no longer lets syncthing touch another app's files :(
- piperswe 7mo agoIt would be strange if Android locked that down further than even iOS - Keepassium on iOS can open files from any sync app IIRC
- antiframe 7mo agoI never enjoyed the Android syncthing experience, so I just plug my phone in once a month and manually copy the vault over. I don't ever edit on my phone, so I don't need two-way syncing.
- alcazar 7mo agoWhat happens if you add a new item on two devices simultaneously?
- isatty 7mo agoWriting a cli with JavaScript? No thank you.
- zie 7mo agoIt's typescript and pretty sure all of the Official Bitwarden clients are written in it. I wrote a version in Python and then rust back before the official CLI was released. Now you can use https://github.com/doy/rbw https://github.com/doy/rbw instead, much better maintained (since I don't use Bitwarden anymore).
- npodbielski 7mo agoWhat do you use?
- zie 7mo agoI have family I need to support, so I use 1password. It also helped that work gives me a 1P family plan free. The practical differences to me: * 1P is aimed at non-tech users more than Bitwarden. * 1P lets you easily store things other than just passwords (serial #'s, license info, SSN's, etc) You can in Bitwarden, but it's a little annoying. * 1P lets you store SSH keys(by effectively being an ssh-agent): https://developer.1password.com/docs/ssh/ All that said, I still happily recommend BW, especially for people that are cost-conscious, the free BW plan is Good Enough for most everyone. Security wise, they are equivalent enough to not matter.
- sega_sai 7mo agoSo how likely is that these compromises will start affecting the non-cli and non-open-source tools ? For example other password managers (in the form of GUI's or browser extensions).
- darkwater 7mo ago> Russian locale kill switch: Exits silently if system locale begins with "ru", checking Intl.DateTimeFormat().resolvedOptions().locale and environment variables LC_ALL, LC_MESSAGES, LANGUAGE, and LANG So bold and so cowards at the same time...
- NewsaHackO 7mo agoThe worst thing is that you can't even tell if that's "real" or just a false flag.
- embedding-shape 7mo agoDoes it matter? Lots of groups do such checks at startup at this point, because every news outlet who reports on it suddenly believe the group to be Russian if you do, so it's a no brainer to add today to misdirect even a little.
- NewsaHackO 7mo agoMy point is that it could still be Russia, as they know that we know it is used as a false flag.
- embedding-shape 7mo agoMy point is; what changes if we knew for a fact it was Russia or that it was someone else?
- NewsaHackO 7mo ago>My point is; what changes if we knew for a fact it was Russia or that it was someone else? Is this a serious question?
- yonatan8070 7mo agoSounds serious to me It's highly unlikely that the people behind an attack like this would come out (non-anonimously) and take credit. And it's unlikely they'll be caught. So does it matter to most peoplee if it's Russians, Americans, Iranians, North Koreans, or some other country? If you're a 3-letter agency, you'd want to know and potentially arrest them, but as a random guy on the internet, or even a maintainer, I really don't think it matters.
- masfuerte 7mo ago> Checkmarx is an information security company specializing in software application security testing and risk management for software supply chains. The irony! The security "solution" is so often the weak link.
- esafak 7mo agoLast month it was trivy: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23 https://github.com/aquasecurity/trivy/security/advisories/GH...
- woodruffw 7mo agoThe adage that security companies are often worse at software security than the median non-security company continues to hold water.
- nothinkjustai 7mo agoRemember how the White House published that document on memory safe languages? I think it’s time they go one step further and ban new development in JavaScript. Horrible language horrible ecosystem and horrible vulns.
- hootz 7mo agoSupply chain attacks aren't exclusive to JS just like malware isn't exclusive to Windows, it's just that JS/Windows is more popular and widespread. Kill JS and you will get supply chain attacks on the next most popular language with package managers. Kill Windows and you will get a flood of Linux/MacOS malware.
- mghackerlady 7mo agoMaybe language based package managers aren't great. Also, npm has design decisions that make it especially prone to supply chain attacks iirc
- dnnddidiej 7mo agoJS apps need more direct dependencies and transitives to do basic things vs. other languages.
- tracker1 7mo agoI was literally thinking about installing the cli a few days ago to ease the use in a few places. Now I'm glad I didn't.
- Scene_Cast2 7mo agoI recently had to disable their Chrome extension because it made the browser grind to a halt (spammed mojo IPC messages to the main thread according to a profiler). I wasn't the only one affected, going by the recent extension reviews. I wonder if it's related.
- bstsb 7mo ago> CLI builds were affected [...] > Bitwarden’s Chrome extension, MCP server, and other legitimate distributions have not been affected yet.
- ruuda 7mo agohttps://github.com/doy/rbw https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.
- ramon156 7mo agoThis + vaultwarden is an awesome self-hostable rust version of bitwarden. We might as well close the loop!
- pregnenolone 7mo agoWell.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.
- mayama 7mo agoThat's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw https://lib.rs/crates/rbw
- embedding-shape 7mo ago326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal. Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world. Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell.
- elAhmo 7mo ago"326 seems large, but not abnormal" was the state of JS in the past as well. Chance of someone auditing all of them is virtually zero, and in practice no one audits anything, so you are still effectively blindly trusting that none of those 326 got compromised.
- fraywing 7mo agoCan we please get a break? Praying to the security gods. It seems like we've have non-stop supply chain attacks for months now?
- dgellow 7mo agoExpect to continue for years to come
- ripped_britches 7mo agoThis is the break right now, we will smile back on these times
- dnnddidiej 7mo agoStock up on pencils and paper guys.
- fnoef 7mo agoI mean, what's the future now? Everyone just vibecoding their own private tools that no "foreign government" has access to? It honestly feels like everything is slowly starting to collapse. Also didn't Microsoft (the owner of GitHub) got access to Claude Mythos in order to "seCuRe cRitiCal SoftWaRe InfRasTructUre FoR teh AI eRa"? Hows securing GitHub Action going for them?
- prima-facie 7mo agoThis is precisely why I don't use BW CLI. Use pass or gopass for all your CLI tokens and sync them via a private git repo. Keep the password manager as a separate desktop app and turn off auto update.
- SV_BubbleTime 7mo agoA supply chain issue that hadn’t happened to BW CLI before is exactly why you use other CLIs that seem to be identically vulnerable to the same issues?
- gnfurlong 7mo agoThat's just not true. The original pass is just a single shell script. It's short, pretty easy to read and likely in part because it's so simple, it's also very stable. The only real dependencies are bash, gnupg and optionally git (history/replication). These are most likely already on your machine and whatever channel you're getting them from (ex: distribution package manager) should be much more resilient to supply chain vulnerabilities. It can also be used with a pgp smartcard (in my case a Yubikey) so all encryption/decryption happens on the smartcard. Every attempt to decrypt a credential requires a physical button press of the yubikey, making it pretty obvious if some malware is trying to dump the contents of the password store.
- asxndu 7mo agoIs there a practical solution to supply chain attacks?
- post-it 7mo agoI've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad). I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party shims over an API, I'll just vibe code the shim myself. If I'm going to be using vibe code either way, better it be mine than someone else's.
- pixel_popping 7mo agoWhy not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?
- Vvector 7mo agoSeamless syncing is the primary reason I stick with BW
- post-it 7mo agoI hope you're not using KeePassX, it's been unmaintained for years. KeePassXC is only available for Linux, which means I'd need to use a third-party app for Mac and iOS, so I'd be trusting three vendors instead of one. Aside from passwords, I store passkeys, secure notes, and MFA tokens.
- pixel_popping 7mo agoKeePassXC is cross-platform, unsure about iOS.
- post-it 7mo agoSorry, you're right, I missed the tabs on top. No iOS support though.
- 7mo ago
- ozgrakkurt 7mo agoTheir website is also incredibly bad. I am not paying for it so it might be better for paying users. It is mind boggling how an app that just lists a bunch of items can be so bloated.
- b40d-48b2-979e 7mo ago"just lists a bunch of items" describes most apps and is incredibly reductive.
- DiffTheEnder 7mo agoI wonder if 1Password CLI is a top priority for hackers similarly.
- y0ssar1an 7mo agoi'm sure it is, but it's written in Rust so it should be a little harder to pwn
- ripped_britches 7mo ago[flagged]
- righthand 7mo agoDont write clis in Javascript.
- xmorse 7mo agoI am working on a project you can self host on Cloudflare with one command, to store secrets and passwords there. It has a cli similar to doppler https://github.com/remorses/sigillo https://github.com/remorses/sigillo
- eranation 7mo agoAnyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versions https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated versions"). Same story for the malicious axios (@1.14.1 and @0.30.4, removed within ~3h), ua-parser-js (hours), and node-ipc (days). Wouldn't have helped with event-stream (sat for 2+ months), but you can't win them all. Some examples (hat tip to https://news.ycombinator.com/item?id=47513932 https://news.ycombinator.com/item?id=47513932): ~/.npmrc min-release-age=7 # days ~/Library/Preferences/pnpm/rc minimum-release-age=10080 # minutes ~/.bunfig.toml [install] minimumReleaseAge = 604800 # seconds # not related to npm, but while at it... ~/.config/uv/uv.toml exclude-newer = "7 days" p.s. shameless plug: I was looking for a simple tool that will check your settings / apply a fix, and was surprised I couldn't find one, I released something (open source, free, MIT yada yada) since sometimes one click fix convenience increases the chances people will actually use it. https://depsguard.com https://depsguard.com if anyone is interested. EDIT: looks like someone else had a similar idea: https://cooldowns.dev https://cooldowns.dev
- dirtbag__dad 7mo agoI guess this is the case for new installs, but for existing dependencies can’t you simply pin them to a patch release, and point at the sha?
- tadfisher 7mo agoCooldowns are passing the buck. These are all caught with security scanning tools, and AI is probably going to be better at this than people going forward, so just turn on the cooldowns server-side. Package updates go into a "quarantine" queue until they are scanned. Only after scanning do they go live.
- eranation 7mo agoI agree, even without project glasswing (that Microsoft is part of) even with cheaper models, and Microsoft's compute (Azure, OpenAI collaboration), it makes no sense that private companies needs to scan new package releases and find malware before npm does. I'm sure they have some reason for it (people rely on packages to be immediately available on npm, and the real use case of patching a zero day CVE quickly), but until this is fixed fundamentally, I'd say the default should be a cooldown (either serverside or not) and you'll need to opt in to get the current behavior. This might takes years of deprecation though, I'm sure it was turned on now, a lot of things would break. (e.g. every CVE public disclosure will also have to wait that additional cooldown... and if Anthropic are not lying, we are bound for a tsunami of patched CVEs soon...)
- 0xbadcafebee 7mo agoThis will continue to happen more and more, until legislation is passed to require a software building code.
- raphinou 7mo agoFrom my understanding the checkmarx attack could have been prevented by the asfaload project I'm working on. See https://github.com/asfaload/asfaload https://github.com/asfaload/asfaload It is: - open source - accountless(keys are identity) - using a public git backend making it easily auditable - easy to self host, meaning you can easily deploy it internally - multisig, meaning event if GitHub account is breached, malevolent artifacts can be detected - validating a download transparantly to the user, which only requires the download url, contrary to sigstore
- qux_ca 7mo agoFYI, Raycast users, the bitwarden-cli version used with the bundled bitwarden extension is 2026-03-01, not the compromised one (2026-04-01). https://github.com/raycast/extensions/blob/6765a533f40ad20cc5e53b9ed0255cc1f50ac5d9/extensions/bitwarden/src/api/bitwarden.ts https://github.com/raycast/extensions/blob/6765a533f40ad20cc...
- 8cvor6j844qw_d6 7mo agoNarrower blast radius than the 2022 LastPass breach, at least the vaults weren't touched.
- y0ssar1an 7mo agothey were cooked the minute they chose to write it in typescript
- stephenlf 7mo agoCrap. I use that CLI.
- mey 7mo agoLooks like Bitwarden has a statement here, https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che...
- jeremie_strand 7mo ago[dead]
- giantfrog 7mo agoHow the hell are most people supposed to balance the risk of not updating software against the risk of updating software?
- eranation 7mo agoIt's a hard decision, I would say a cooldown by default in the last few months would have prevented more attacks than not upgrading to the latest version due to an immediate RCE, zero-click, EPSS 100%, CVSS 10.0, KEV mentioned Zero Day CVE. But now that the Mythos 90 days disclosure window gets closer, I don't know what tsunami of urgent patches is in our way... it's not an easy problem to solve. I lean toward cooldown by default, and bypass it when an actual reachable exploitable ZeroDay CVE is released.
- progval 7mo agoUse a package repository that fast-tracks security updates, like Debian Stable.
- lxgr 7mo agoWhat's particularly impressive about this attack is that the attackers must have precisely coordinated it with Github not being down.
- ninju 7mo agoGithub has had some recent uptime issues https://mrshu.github.io/github-statuses/ https://mrshu.github.io/github-statuses/
- deleted 7mo ago[deleted]
- ef2k 7mo agoThe issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what you're building can put your company out of business it's worth the hassle.
- fragmede 7mo agoBut it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.
- kronks 7mo ago[dead]
- bfivyvysj 7mo agoWhy would you patch a security vuln in a later version? Should be patched in all versions.. that's what semver is for.
- jpleger 7mo agoAh yes the incredibly common practice of... checks notes backporting security packages in node packages.
- kijin 7mo agoSemver doesn't help if you just declare all older versions EOL. What you're looking for are Debian stable packages. :p
- raincole 7mo agoWho is 'you' here? All of the npm package maintainers? Yes, if they all just backport security patches we'll be fine. No, people are not going to just.
- deleted 7mo ago[deleted]
- deleted 7mo ago[deleted]
- pievalentin 7mo agoSomehow thats good because the rest of the Bitwarden apps will benefit from the increased tightness of their tooling and ci/cd
- erans 7mo agoThe part that seems most important here is that npm install was enough. Once the compromise point is preinstall, the usual "inspect after install" mindset breaks down. By then the payload has already had a chance to run. That gets more interesting with agents / CI / ephemeral sandboxes, because short exposure windows are still enough when installs happen automatically and repeatedly. Another thing I think is worth paying attention to: this payload did not just target secrets, it also targeted AI tooling config, and there is a real possibility that shell-profile tampering becomes a way to poison what the next coding assistant reads into context. I work on AgentSH (https://www.agentsh.org https://www.agentsh.org), and we wrote up a longer take on that angle here: https://www.canyonroad.ai/blog/the-install-was-the-attack/ https://www.canyonroad.ai/blog/the-install-was-the-attack/
- hsbauauvhabzb 7mo agoNobody inspects packages after install, your theory has been debunked multiple times, caring about npm install running scripts is moot when you’ll inevitably run the actual binary after install. And besides, you could always pull the package and inspect before running install, which unless you really know the installer and understand/know guarantees deeply (e.g., whether it’s possible for an install to deploy files outside of node_modules) it’s insane to even vaguely trust it to pull and unpack potentially malicious code.
- boardwaalk 7mo agoI'm just hearing about this attack on Checkmarx. We recently adopted it at work, and I find the thing to just produce garbage. I've never tuned out noise so quickly. you have to appreciate the irony of a thing that's supposed to help protect you from vulnerabilities being one.
- xtracto 7mo agoI think this is the real news. There seems to be an ongoing attack against Checkmarx. That thing is expensive as he'll and used by lots of huge corps. I know at least one very large one in Mexico ... where the IT team is pretty useless. So, I dont doubt the possibility that in the short future we will hear about more hacks.
- gchamonlive 7mo agoI am glad I consciously decided not to put 2FA keys when I adopted bitwarden back in 2021, and manage them with Aegis. It was a bit of a hassle to setup backups, but it's good to split your points of failure.
- Ms-J 7mo ago[dead]
- archargelod 7mo agoThat's why I don't use any third-party password managers. You have to trust them not to fuck up security, updates, backups, etc. etc. I wrote my own password generator - it's stateless, which has the advantage that I never have to back up or sync any data between devices. It just lets you enter a very long, secure master password, service name and a username then runs an scrypt hash on this with good enough parameters to make brute-force attacks unfeasible. For anything important, I also use 2FA.
- GaryBluto 7mo agoTo use a fitting turn of phrase, "Many such cases." How many times will this happen before people realise that updating blind is a poor decision?
- nh43215rgb 7mo ago> THE MOST TRUSTED PASSWORD MANAGER > Defend against hackers and data breaches > Fix at-risk passwords and stay safe online with Bitwarden, the best password manager for securely managing and sharing sensitive information. yep. literally from their website this moment..and the link to their "statement"[0] is nowhere on the front page. Oh wait, there is a top banner..."Take insights to action: Bitwarden Access Intelligence now available Learn more >" nope. [0]: https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127 https://community.bitwarden.com/t/bitwarden-statement-on-che...
- max2026 7mo ago[dead]
- saidnooneever 7mo agosome coffee apps will be malicious now with 'melange' as IoC haha.. and Navigator xD... but i guess netscape is kinda malware o.O. on a more serious note. i told you so levels reaching new heights. dont use password managers. dont handoff this type of risk to a third party. its like putting all your keys in a flimsy lockbox outside of your appartment. at some point someone will trip over it, find the keys and explore -_-. it being impractical with the amount of keys/passwords you need to juggle? not an excuse. problem should and can be solved differently.
- gcolella 7mo agoSupply chain attacks via package managers are exactly the nightmare scenario. A few months ago I had a production issue where a composer dependency got silently nuked from our vendor/ — the package was setasign/fpdf. Before restoring it, my first instinct was "did someone compromise the repo?". Turned out to be local, but the 10 minutes between discovery and confirmation were terrifying. Now we pin every dependency by hash in composer.lock and review any change in it before deployment. Still not enough — if the registry itself is compromised, the hash pin saves you only from drive-by tampering, not from poisoned-at-origin uploads. Feels like we need something like Sigstore-level attestation for PHP/npm at minimum.
- saadn92 7mo agoIf anyone is looking for something local: https://github.com/saadnvd1/xpass https://github.com/saadnvd1/xpass
- gcolella 7mo ago[dead]
- thedangler 7mo agodoes this affect the windows and mac,iphone apps?
- traderj0e 7mo agoShouldn't a secret manager company be stricter about what third-party code they use anywhere? I don't think this kind of thing flies at Google or Apple.
- latexr 7mo ago> attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline. I don’t even trust GitHub’s own actions. I used to use only the one to checkout a repository, limited to a specific tag, but then realised that even a tagged version, if it has dependencies which are not themselves tagged, could be compromised, so I stopped and now do the checkout myself. It’s not even that many lines of code, the fact GitHub has a huge npm package with dependencies to do something this basic is insane.
- dimitry12 7mo agoFrom Bitwarden official statement: https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127/28 https://community.bitwarden.com/t/bitwarden-statement-on-che... "a malicious package that was briefly distributed" "investigation found no evidence that end user vault data was accessed or at risk" "The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data." "Users who did not download the package from npm during that window were not affected." Downplaying so hard it's disgusting. Bitwarden failed and became a vector of attack. A vendor who is responsible for all my passwords. What a joke. All trust lost: by the incident and comms-style. Time to move before they make an even bigger mistake.
- hawk_aa 7mo ago[dead]
- zhenjing 7mo agoI made a scanner(ActionPin) for the workflow patterns this compromise exposed. ActionPin — a GitHub Actions hardening checker that flags unpinned third-party actions, overbroad workflow permissions, install scripts that touch secrets, and agent-triggered jobs that can reach production credentials. ActionPin host on github.