Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

221–230 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#221

Post by NewsaHackO »

yonatan8070 wrote: post #203
NewsaHackO wrote: post #167

Earlier quoted context omitted.

>My point is; what changes if we knew for a fact it was Russia or that it was someone else? Is this a serious question?

Sounds serious to me It's highly unlikely that the people behind an attack like this would come out (non-anonimously) and take credit. And it's unlikely they'll be caught. So does it matter to most peoplee if it's Russians, Americans, Iranians, North Koreans, or some other country? If you're a 3-letter agency, you'd want to know and potentially arrest them, but as a random guy on the internet, or even a maintainer, I…

So if it came out that the NSA was attempting to put backdoors in consumer password managers, it wouldn't change the context of the side channel attack? How about if it was a company (like Google)? It seemed like an unserious question because I can't understand how someone would think something like that wouldn't change the situation.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#223

Post by PunchyHamster »

eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

Don't write anything backend or cli tool in NPM would be good start

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#224

Post by dwedge »

tredre3 wrote: post #205
brightball wrote: post #48

Earlier quoted context omitted.

The problem is that the UX with a browser extension is so much better.

> The problem is that the UX with a browser extension is so much better. It's better, but calling it so much better [that it's unreasonable to forgo the browser extension] is a bit silly to me. 1. Go to website login page 2. trigger the global shortcut that will invoke your password manager 3. Your password manager will appear with the correct entry usually preselected, if not type 3 letters of the site's name. 4. Pr…

How do you set up this shortcut? I'd prefer to get rid of extensions, if for no better reason than sometimes it switches to my work profile and I have to re-login

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#225

Post by post-it »

pixel_popping wrote: post #86
post-it wrote: post #81

I've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad). I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party…

Why not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?

I hope you're not using KeePassX, it's been unmaintained for years. KeePassXC is only available for Linux, which means I'd need to use a third-party app for Mac and iOS, so I'd be trusting three vendors instead of one.

Aside from passwords, I store passkeys, secure notes, and MFA tokens.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#226

Post by somehnguy »

4ndrewl wrote: post #184
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

The problem with cooldowns is that the more people use them, the less effective they become.

That was my first instinct as well but I'm not sure how true it really is.

Many companies exist now whose main product is supply chain vetting and scanning (this article is from one such company). They are usually the ones writing up and sharing articles like this - so the community would more than likely hear about it even if nobody was actually using the package yet.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#227

Post by ievans »

tomesco wrote: post #196
bdangubic wrote: post #193

Earlier quoted context omitted.

care to elaborate?

https://news.ycombinator.com/item?id=47773812

Top comment has a great explicit refutation:

> This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, with manual triggers for those libraries which are not in the top N.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#228

Post by 12_throw_away »

4ndrewl wrote: post #184
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

The problem with cooldowns is that the more people use them, the less effective they become.

The hypothesis you're referring to is something like "if everyone uses a 7-day cooldown, then the malware just doesn't get discovered for 7 days?", right?

An alternative hypothesis: what if 7-day cooldowns incentivize security scanners, researchers, and downstream packagers to race to uncover problems within an 7-day window after each release?

Without some actual evidence, I'm not sure which of these is correct, but I'm pretty sure it's not productive to state either one of these as an accepted fact.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#229

Post by ef2k »

The issue was a compromised build pipeline that shipped a poisoned package.

But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose.

If what you're building can put your company out of business it's worth the hassle.

Post reply on HN