Writing a cli with JavaScript? No thank you.
Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
21–30 of 458 posts
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#22Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries , that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838
> A password manager does not need a CLI tool.
Why not? Even macos keychain supports cli.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#23If I run the compromised CLI, do they get all my passwords?
No, at least according to Bitwarden themselves: https://community.bitwarden.com/t/bitwarden-statement-on-che...
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#24Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries , that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838
Yeah Im going to have to agree with this
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#25So how likely is that these compromises will start affecting the non-cli and non-open-source tools ? For example other password managers (in the form of GUI's or browser extensions).
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#26KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.
I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#27I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of…
[deleted]
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#28> Russian locale kill switch: Exits silently if system locale begins with "ru", checking Intl.DateTimeFormat().resolvedOptions().locale and environment variables LC_ALL, LC_MESSAGES, LANGUAGE, and LANG
So bold and so cowards at the same time...
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#29> Checkmarx is an information security company specializing in software application security testing and risk management for software supply chains.
The irony! The security "solution" is so often the weak link.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#30I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of…
Wow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.
I don't know, I use a vanilla weechat setup