Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

11–20 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#13

Post by hgoel »

Does the CLI auto-update?

Edit: The CLI itself apparently does not, which will have limited the damage a bit, but if it's installed as a snap, it might. Incidents like this should hopefully cause a rollback of this dumb system of forcefully and frequently updating people's software without explicit consent.

Also the time range provided in https://community.bitwarden.com/t/bitwarden-statement-on-che... can help with knowing if you were at risk. I only used the CLI once in the morning yesterday (ET), so I might not have been affected?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#14

Post by hgoel »

rtaylorgarlock wrote: post #12
NeckBeardPrince wrote: post #9

Earlier quoted context omitted.

Read the article

kinda crazy to see this comment required in this particular context, yet here we are

It's an understandable question, the article reads like an AI generated mess.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#15

Post by flossly »

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions?

Quite bizarre to think much much of my well-being depends on those secrets staying secret.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#16

Post by rvz »

Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go.

If you see any package that has hundreds of libraries, that increases the risk of a supply chain attack.

A password manager does not need a CLI tool.

[0] https://news.ycombinator.com/item?id=47585838

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#17

Post by trinsic2 »

1024kb wrote: post #7

I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of…

Wow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#19

Post by hrimfaxi »

> The affected package version appears to be @bitwarden/cli2026.4.0, and the malicious code was published in bw1.js, a file included in the package contents. The attack appears to have leveraged a compromised GitHub Action in Bitwarden’s CI/CD pipeline, consistent with the pattern seen across other affected repositories in this campaign.
Post reply on HN