FYI, Raycast users, the bitwarden-cli version used with the bundled bitwarden extension is 2026-03-01, not the compromised one (2026-04-01).
https://github.com/raycast/extensions/blob/6765a533f40ad20cc...
Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
151–160 of 458 posts
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#152Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.
How to prevent it?
tl;dr
(disclaimer: I maintain the 2nd one, if I knew of the first, I wouldn't have released it, just didn't find something at that time, they do pretty much the same thing, mine in a bit of an overkill by using rust...)
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#153Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go. If you see any package that has hundreds of libraries , that increases the risk of a supply chain attack. A password manager does not need a CLI tool. [0] https://news.ycombinator.com/item?id=47585838
I seems like we need better standard libraries, but standard libraries turn into tarpits. I sort of like the way python's stdlib works.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#154Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.
We need cooldowns everywhere , by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.
I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update?
We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#155Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…
Cooldowns are passing the buck. These are all caught with security scanning tools, and AI is probably going to be better at this than people going forward, so just turn on the cooldowns server-side. Package updates go into a "quarantine" queue until they are scanned. Only after scanning do they go live.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#156Earlier quoted context omitted.
Which is great for Hacker News users that can maintain their own infra. But if we're talking "stress free", that's not an answer for the average user...
what "infra"? keepass works locally, and just opens a database file. it works the same as any other password manager.
Most other password managers have a cloud component so if your local storage breaks or gets lost you don't lose all your passwords.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#157Remember how the White House published that document on memory safe languages? I think it’s time they go one step further and ban new development in JavaScript. Horrible language horrible ecosystem and horrible vulns.
Supply chain attacks aren't exclusive to JS just like malware isn't exclusive to Windows, it's just that JS/Windows is more popular and widespread. Kill JS and you will get supply chain attacks on the next most popular language with package managers. Kill Windows and you will get a flood of Linux/MacOS malware.
Maybe language based package managers aren't great. Also, npm has design decisions that make it especially prone to supply chain attacks iirc
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#158Earlier quoted context omitted.
We need cooldowns everywhere , by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.
That is why we have discussions like these: https://x.com/i/status/2039099810943304073
X is the worst place to hold community discussions.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#159Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.
Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.
In theory the browser integration shouldn’t leak anything beyond the credentials being used, even if compromised.
When you use autofill, the native application will prompt to disclose credentials to the extension. At that point, only those credentials go over the wire. Others remain inaccessible to the extension.
Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign
#160Earlier quoted context omitted.
We need cooldowns everywhere , by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.
I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update? We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.
These vulnerabilities are all caught by scanners and the packages are taken down 2-3 hours after going live. Nothing needs to take 7 days, that's just a recommendation. But maybe all packages should be scanned, which apparently only takes a couple of hours, before going live to users?