Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

191–200 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#191

Post by hombre_fatal »

vablings wrote: post #173
pregnenolone wrote: post #91

Earlier quoted context omitted.

Well.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.

Wait, you're telling me that node deps are not pin by default. Every time you run your code you might be pulling in a new version. No wonder...

Node deps are pinned: https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-j...

The problem is that you also want to update deps.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#192

Post by john_strinlai »

embedding-shape wrote: post #106
NewsaHackO wrote: post #99

Earlier quoted context omitted.

My point is that it could still be Russia, as they know that we know it is used as a false flag.

My point is; what changes if we knew for a fact it was Russia or that it was someone else?

for most people, nothing.

for threat intel people, a lot.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#193

Post by bdangubic »

4ndrewl wrote: post #184
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

The problem with cooldowns is that the more people use them, the less effective they become.

care to elaborate?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#194

Post by john_strinlai »

gbalduzzi wrote: post #148
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

I don't understand how this solves the issue in this case. Bitwarden vaults were not compromised, there was a problem in a tool you used to access the secrets. What makes it impossible for KeePass access tools to have these issues?

>What makes it impossible for KeePass access tools to have these issues?

the superiority of keepass users scares away the bad actors

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#195

Post by edf13 »

doctorpangloss wrote: post #188
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

Haha what if there's an urgent security fix in an updated package?

Manually review the package and override the setting

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#200

Post by eranation »

doctorpangloss wrote: post #188
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

Haha what if there's an urgent security fix in an updated package?

Yep, that's the main argument against cooldowns, but there are ways to override them. I'll update the docs soon.
Post reply on HN