Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign • Hacker News Board

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#81

Post by post-it » Thu, Apr 23, 2026, 3:59 PM UTC

I've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad).

I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party shims over an API, I'll just vibe code the shim myself. If I'm going to be using vibe code either way, better it be mine than someone else's.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#82

Post by embedding-shape » Thu, Apr 23, 2026, 3:59 PM UTC

NewsaHackO wrote: post #33

darkwater wrote: post #28

> Russian locale kill switch: Exits silently if system locale begins with "ru", checking Intl.DateTimeFormat().resolvedOptions().locale and environment variables LC_ALL, LC_MESSAGES, LANGUAGE, and LANG So bold and so cowards at the same time...

The worst thing is that you can't even tell if that's "real" or just a false flag.

Does it matter? Lots of groups do such checks at startup at this point, because every news outlet who reports on it suddenly believe the group to be Russian if you do, so it's a no brainer to add today to misdirect even a little.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#83

Post by piperswe » Thu, Apr 23, 2026, 3:59 PM UTC

jasonjayr wrote: post #36

piperswe wrote: post #32

Earlier quoted context omitted.

Syncthing can synchronize Keepass files between devices quite well.

I rely on this too, but counting down the days android no longer lets syncthing touch another app's files :(

It would be strange if Android locked that down further than even iOS - Keepassium on iOS can open files from any sync app IIRC

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#84

Post by embedding-shape » Thu, Apr 23, 2026, 4:00 PM UTC

iririririr wrote: post #71

darkwater wrote: post #28

> Russian locale kill switch: Exits silently if system locale begins with "ru", checking Intl.DateTimeFormat().resolvedOptions().locale and environment variables LC_ALL, LC_MESSAGES, LANGUAGE, and LANG So bold and so cowards at the same time...

ah yes, because everyone sets locale on their npm publish github CI job. obvious misdirection, but it does serve to make it very obvious it was a state actor.

> but it does serve to make it very obvious it was a state actor

Lol no, lots of groups do this, non-state ones too.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#85

Post by zie » Thu, Apr 23, 2026, 4:00 PM UTC

isatty wrote: post #21

Writing a cli with JavaScript? No thank you.

It's typescript and pretty sure all of the Official Bitwarden clients are written in it.

I wrote a version in Python and then rust back before the official CLI was released. Now you can use https://github.com/doy/rbw instead, much better maintained (since I don't use Bitwarden anymore).

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#86

Post by pixel_popping » Thu, Apr 23, 2026, 4:01 PM UTC

post-it wrote: post #81

I've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad). I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party…

Why not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#87

Post by pertique » Thu, Apr 23, 2026, 4:01 PM UTC

pregnenolone wrote: post #45

mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

> KeePass users continue to live the stress free live. https://cyberpress.org/hackers-exploit-keepass-password-mana...

This article is borderline malicious in how it skirts the facts.

This wasn't a case where KeePass was compromised in any way, as far as I can tell. This appears to be a basic case of a threat actor distributing a trojanized version via malicious ads. If users made sure they are getting the correct version, they were never in danger. That's not to say that a supply chain attack couldn't affect KeePass, but this article doesn't say that it has.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#88

Post by ozgrakkurt » Thu, Apr 23, 2026, 4:01 PM UTC

Their website is also incredibly bad. I am not paying for it so it might be better for paying users.

It is mind boggling how an app that just lists a bunch of items can be so bloated.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#89

Post by zie » Thu, Apr 23, 2026, 4:02 PM UTC

hgoel wrote: post #13

Does the CLI auto-update? Edit: The CLI itself apparently does not, which will have limited the damage a bit, but if it's installed as a snap, it might. Incidents like this should hopefully cause a rollback of this dumb system of forcefully and frequently updating people's software without explicit consent. Also the time range provided in https://community.bitwarden.com/t/bitwarden-statement-on-che... can help with k…

I think you had to have installed the CLI during that time-frame, then ran the brand new installed CLI to be vulnerable.

Assuming you had it already installed, you would be safe.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#90

Post by jeroenhd » Thu, Apr 23, 2026, 4:03 PM UTC

ErneX wrote: post #11

sigmonsays wrote: post #3

If I run the compromised CLI, do they get all my passwords?

The article explains what is extracted.

The article waffles on forever and gives some generic advice.

Meanwhile, Bitwarden themselves state that end users were almost never affected: https://community.bitwarden.com/t/bitwarden-statement-on-che...

You had to install the CLI through NPM at a very short time frame for it to be affected. If you did get infected, you have to assume all secrets on your computer were accessed and that any executable file you had write access to may be backdoored.