Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

171–180 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#171

Post by mrWiz »

1024kb wrote: post #26
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.

I use MacOS and iOS for home home devices and Windows for work, and use Strongbox on the Apple side with KeePassXC on the Windows side and sync them using DropBox.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#173

Post by vablings »

pregnenolone wrote: post #91
ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

Well.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.

Wait, you're telling me that node deps are not pin by default. Every time you run your code you might be pulling in a new version.

No wonder...

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#175

Post by infogulch »

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

Oh nice it works as an ssh-agent too. Definitely checking this one out.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#176

Post by prdonahue »

eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

> Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)?

Most of these attacks don't make it into the upstream source, so solutions[1] that build from source get you ~98% of the way there. If you can't get a from-source build vs. pulling directly from the registries, can reduce risk somewhat with a cooldown period.

For the long tail of stuff that makes it into GitHub, you need to do some combination of heuristics on the commits/maintainers and AI-driven analysis of the code change itself. Typically run that and then flag for human review.

[1] Here's the only one I know that builds everything from source: https://www.chainguard.dev/libraries

(Disclaimer: I work there.)

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#177

Post by tadfisher »

woodruffw wrote: post #168
tadfisher wrote: post #155

Earlier quoted context omitted.

Cooldowns are passing the buck. These are all caught with security scanning tools, and AI is probably going to be better at this than people going forward, so just turn on the cooldowns server-side. Package updates go into a "quarantine" queue until they are scanned. Only after scanning do they go live.

"Just" is doing a lot of work; most ecosystems are not set up or equipped to do this kind of server-side queuing in 2026. That's not to say that we shouldn't do this, but nobody has committed the value (in monetary and engineering terms) to realizing it. Perhaps someone should. By contrast, a client-side cooldown doesn't require very much ecosystem or index coordination.

Yeah, I should work on avoiding that word.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#178

Post by zie »

npodbielski wrote: post #163
zie wrote: post #85

Earlier quoted context omitted.

It's typescript and pretty sure all of the Official Bitwarden clients are written in it. I wrote a version in Python and then rust back before the official CLI was released. Now you can use https://github.com/doy/rbw instead, much better maintained (since I don't use Bitwarden anymore).

What do you use?

I have family I need to support, so I use 1password. It also helped that work gives me a 1P family plan free.

The practical differences to me:

    * 1P is aimed at non-tech users more than Bitwarden.
    * 1P lets you easily store things other than just passwords (serial #'s, license info, SSN's, etc) You can in Bitwarden, but it's a little annoying.
    * 1P lets you store SSH keys(by effectively being an ssh-agent): https://developer.1password.com/docs/ssh/
All that said, I still happily recommend BW, especially for people that are cost-conscious, the free BW plan is Good Enough for most everyone.

Security wise, they are equivalent enough to not matter.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#179

Post by [deleted] »

epistasis wrote: post #115
stvnbn wrote: post #95

Earlier quoted context omitted.

I love how the first comment is a complain having nothing to do with the actual subjec

Password managers are all about trust, the main link is about a compromise, so it's not surprising that the first comment is also about trust too, even if it's not directly about this particular compromise. I found the default bwcli clunky and unacceptable, and it's why I don't use it, even though I still have a BitWarden subscription.

[deleted]

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#180

Post by eipi10_hn »

Perz1val wrote: post #132
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

Ok, single file, blah, blah. Realistically how do you sync that and how do you resolve conflicts? What happens if two devices add a password while offline, then go online?

I actually was a Bitwarden user at first, but over time in reality the frequency that I change email/password is not that much. It's not like I change those things every hour or every day like with my work files/documents and need constant syncing to the drive. And the chance that I add/change passwords at 2 devices at a close time is even less.

So gradually I don't feel I need syncing that much any more and switched to Keepass. I made my mind that I'll only change the database from my computer and rclone push that to any cloud I like (I'm using Koofr for that since it's friendly to rclone) then in any other devices I'll just rclone pull them after that when needed. If I change something in other devices (like phones), I'll just note locally there and change the database later.

But ofc if someone needs to change their data/password frequently then Bitwarden is clearly the better choice.

Post reply on HN