Yesterday, security firm Socket published findings that the Bitwarden CLI - the command-line version of the popular password manager - was compromised as part of an active supply chain attack. Over 50,000 businesses use Bitwarden. If any of your staff or developers use it via the command line or in automated scripts, this matters.
Here's what you need to know without the security jargon.
What Happened
A group called Checkmarx - not the legitimate Checkmarx security company, but attackers using a similar name to cause confusion - has been running a campaign that compromises popular open-source tools by hijacking their automated publishing pipelines.
Think of it like this: software packages get published automatically by a robot (called a CI/CD pipeline). The attacker found a way to sneak into that robot and modify what it packages before publishing. So when you install what looks like the real Bitwarden CLI, you're installing a version that has extra code hidden in it.
The specific version compromised is @bitwarden/cli 2026.4.0, published via npm (the main repository where JavaScript software is distributed).
What the hidden code does:
- Steals GitHub authentication tokens from memory
- Harvests AWS, Azure, and Google Cloud credentials
- Reads npm configuration files looking for access tokens
- Sends all of it to an external server controlled by the attackers
Who Is Actually Affected
The key distinction here: this attack targets the CLI version only, not the app most people use.
If you or your team:
- Use Bitwarden via the browser extension to save and fill passwords: you are not affected
- Use the Bitwarden desktop app: you are not affected
- Use the Bitwarden mobile app: you are not affected
The affected version specifically hits:
- Developers or IT staff who installed Bitwarden CLI via
npm install @bitwarden/cli - Automated scripts or CI/CD pipelines that use Bitwarden CLI to retrieve secrets
- Any workflow that references the compromised npm package
If you run a business and your team uses Bitwarden like a normal password manager through the browser or app, this is likely not your problem today. But if you have developers or someone who set up automated scripts - check with them.
What the Researchers Recommend
Socket's guidance, translated:
1. Check if the compromised version is installed. If you or your developers use Bitwarden CLI, run this command in your terminal:
npm list @bitwarden/cli
If it shows version 2026.4.0, you have the compromised version.
2. Rotate your secrets immediately. If the compromised version was installed in any environment, treat all credentials it had access to as stolen. That means rotating:
- GitHub personal access tokens
- AWS access keys
- Azure tokens
- GCP credentials
- npm tokens
This is non-negotiable. The attacker already has them.
3. Review your CI/CD logs.
If you use automated pipelines (GitHub Actions, etc.), look at recent logs for unexpected outbound network calls or anything calling audit.checkmarx[.]cx.
4. Downgrade or remove the CLI package. Uninstall the compromised version and use an older, verified version until Bitwarden publishes a clean fix.
The Bigger Picture
This attack is part of a growing pattern. Supply chain attacks - where bad actors compromise not the software you use directly, but the tools used to build and distribute that software - are becoming the preferred method for stealing business credentials.
The GitHub Actions abuse is particularly common right now. Attackers find a vulnerability in the automated pipeline that publishes a tool you trust, modify the code at the publishing stage, and wait for businesses to install it through normal update processes.
The reason this matters: your antivirus won't catch it. The code is signed. It looks legitimate. It comes from the right place. The only defense is monitoring what your software does after installation.
For most small business owners, the practical lesson is this: whoever manages your business's technical infrastructure needs to know about this today. If that's you, flag it to whoever set up your development tools. If that's a contractor or employee, forward them this article and ask them to verify your Bitwarden CLI version.
What Bitwarden Has Said
As of publishing, Bitwarden has not released a public statement. Socket says their investigation is ongoing and they'll publish a full technical analysis including all indicators of compromise. We'll update this article when Bitwarden responds.
The Bitwarden Chrome extension, MCP server, and all non-npm distributions are confirmed unaffected at this time.
Sources:
- Socket Research Team - Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign, April 23, 2026
- Hacker News discussion, 755 points, 365 comments
Sam Torres covers regulatory actions, security alerts, and policy news affecting small business owners. She tracks government enforcement and emerging threats so you don't have to.