Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

271–280 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#271

Post by embedding-shape »

seanw444 wrote: post #267
embedding-shape wrote: post #257

Earlier quoted context omitted.

That's because you're mixing things. "Rust the language" isn't the one starting new projects and add new dependencies that have hundreds of dependencies of their own, this is the doing of developers. The developers who built Rust with a focus on safety and security is not the same developers mentioned before.

That's true. But it does seem like a logic result of having no real standard library. That lone fact has kept me away from Rust for real projects, because I don't want to pull in a bunch of defacto-standard-but-not-officially dependencies for simple tasks. That's probably a large contributor to the current state of dependency bloat.

Yeah, it does require you to be meticulous about what you depend on. Personally I stick with libraries that don't use 100s of other crates, and tried and reviewed various libraries over the year, so you have your "toolkit" of libraries you know are well built and you know how they work internally.

Ultimately in any language you get the sort of experience you build for yourself with the environment you setup, it is possible in most languages to be more conservative and minimal even if the ecosystem at large is not, but it does require more care and time.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#272

Post by cromka »

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

It's a bit ironic that everyone considers Rust as safer while completely ignoring the heavily increased risk of pulling in malware in dependencies.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#273

Post by cromka »

seanw444 wrote: post #231
elAhmo wrote: post #219

Earlier quoted context omitted.

"326 seems large, but not abnormal" was the state of JS in the past as well. Chance of someone auditing all of them is virtually zero, and in practice no one audits anything, so you are still effectively blindly trusting that none of those 326 got compromised.

It is baffling to me that a language that is as focused on safety/security as Rust decided to take the JavaScript approach to their ecosystem. I find it rather contradictory.

Same here.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#274

Post by kjok »

abustamam wrote: post #255
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

I like the idea of a cool down. But my next question is would this have been caught if no one updated? I know in practice not everyone would be on a cool down. But presumably this comprise was only found out because a lot of people did update.

Cooldown sounds like a good idea ONLY IF these so called security companies can catch these malicious dependencies during the cooldown period. Are they doing this bit or individual researchers find a malware and these companies make headlines?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#275

Post by Yolopix »

zie wrote: post #178
npodbielski wrote: post #163

Earlier quoted context omitted.

What do you use?

I have family I need to support, so I use 1password. It also helped that work gives me a 1P family plan free. The practical differences to me: * 1P is aimed at non-tech users more than Bitwarden. * 1P lets you easily store things other than just passwords (serial #'s, license info, SSN's, etc) You can in Bitwarden, but it's a little annoying. * 1P lets you store SSH keys(by effectively being an ssh-agent): https://de…

Bitwarden can also act as an ssh-agent: https://bitwarden.com/help/ssh-agent/

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#276

Post by gck1 »

prmoustache wrote: post #249
aborsy wrote: post #134

Earlier quoted context omitted.

How is the quality of browser extensions compared to Bitwarden?

You don't use a browser extension if you are serious about security anyway.

How do you autofill from your db then?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#277

Post by aucisson_masque »

NewsaHackO wrote: post #221
yonatan8070 wrote: post #203

Earlier quoted context omitted.

Sounds serious to me It's highly unlikely that the people behind an attack like this would come out (non-anonimously) and take credit. And it's unlikely they'll be caught. So does it matter to most peoplee if it's Russians, Americans, Iranians, North Koreans, or some other country? If you're a 3-letter agency, you'd want to know and potentially arrest them, but as a random guy on the internet, or even a maintainer, I…

So if it came out that the NSA was attempting to put backdoors in consumer password managers, it wouldn't change the context of the side channel attack? How about if it was a company (like Google)? It seemed like an unserious question because I can't understand how someone would think something like that wouldn't change the situation.

Does the nsa really need that ? 99% of our services are hosted on American servers, which the nsa already has full access.

Why would you steal the key when you're already in the house ?

And for the high profile, like some Iranian scientist who has the code to something important, they wouldn't use things like bitwarden.

I really see no use case when the nsa would need access to your bitwarden vault.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#278

Post by koyote »

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

I wonder if this is going to push more software to stacks like .Net where you can do most things with zero third-party dependencies.

Or, conversely, encourage programming languages to increase the number of features in their standard libraries.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#279

Post by Ukv »

abustamam wrote: post #255
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

I like the idea of a cool down. But my next question is would this have been caught if no one updated? I know in practice not everyone would be on a cool down. But presumably this comprise was only found out because a lot of people did update.

> presumably this comprise was only found out because a lot of people did update

This was supposedly discovered by "Socket researchers", and the product they're selling is proactive scanning to detect/block malicious packages, so I'd assume this would've been discovered even if no regular users had updated.

But I'd claim even for malware that's only discovered due to normal users updating, it'd generally be better to reduce the number of people affected with a slow roll-out (which should happen somewhat naturally if everyone sets, or doesn't set, their cool-down based on their own risk tolerance/threat model) rather than everyone jumping onto the malicious package at once and having way more people compromised than was necessary for discovery of the malware.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#280

Post by nirvdrum »

c2h5oh wrote: post #247
MetaWhirledPeas wrote: post #245

Earlier quoted context omitted.

Other package managers are magically immune?

They are not, but npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help https://github.com/node-forward/discussions/issues/29

The lack of a comprehensive standard library for JavaScript also results in projects pulling many more third party dependencies than you would with most other modern environments. It’s just a bigger attack surface. And if you can compromise a module used for basic functionality that you’d get out of the box elsewhere, the blast radius will be enormous.
Post reply on HN