Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

281–290 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#281

Post by wongarsu »

seanw444 wrote: post #267
embedding-shape wrote: post #257

Earlier quoted context omitted.

That's because you're mixing things. "Rust the language" isn't the one starting new projects and add new dependencies that have hundreds of dependencies of their own, this is the doing of developers. The developers who built Rust with a focus on safety and security is not the same developers mentioned before.

That's true. But it does seem like a logic result of having no real standard library. That lone fact has kept me away from Rust for real projects, because I don't want to pull in a bunch of defacto-standard-but-not-officially dependencies for simple tasks. That's probably a large contributor to the current state of dependency bloat.

'no real standard library' doesn't seem entirely fair. Rust has a huge standard library. What it does have is the policy to only include "mature" things with little expected API evolution in the standard libary, which leaves gaping holes where a json parser, a http client or a logging library should be. Those are all those defacto-standard-but-not-officially dependencies

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#282

Post by mort96 »

embedding-shape wrote: post #257
seanw444 wrote: post #231

Earlier quoted context omitted.

It is baffling to me that a language that is as focused on safety/security as Rust decided to take the JavaScript approach to their ecosystem. I find it rather contradictory.

That's because you're mixing things. "Rust the language" isn't the one starting new projects and add new dependencies that have hundreds of dependencies of their own, this is the doing of developers. The developers who built Rust with a focus on safety and security is not the same developers mentioned before.

Rust and Cargo are, if not inseparable, at least tightly connected. Rust and Rust's stdlib are inseparable.

Cargo is modeled after NPM. It works more or less identically, and makes adding thousands of transient dependencies effortless, just like NPM.

Rust's stdlib is pretty anemic. It's significantly smaller than node's.

These are decisions made by the bodies governing Rust. It has predictable results.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#283

Post by prmoustache »

gck1 wrote: post #276
prmoustache wrote: post #249

Earlier quoted context omitted.

You don't use a browser extension if you are serious about security anyway.

How do you autofill from your db then?

I don't autofill. It may be less user friendly but it is not that big of a deal.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#284

Post by fdsajfkldsfklds »

eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

Never, ever type "npm -i". This advice has served me well for many years.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#285

Post by boardwaalk »

I'm just hearing about this attack on Checkmarx.

We recently adopted it at work, and I find the thing to just produce garbage. I've never tuned out noise so quickly.

you have to appreciate the irony of a thing that's supposed to help protect you from vulnerabilities being one.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#286

Post by flossly »

zerkten wrote: post #43
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.

On iOS I feel I have less control over what's running than on Linux (dont get me started on Windows or Android). So that's the order of how I dare to use it. But a supply chain attack: I'll always use a distributed program: the only thing I can do is only use old versions, and trusted distribution channels.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#287

Post by [deleted] »

zerkten wrote: post #43
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.

[deleted]

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#288

Post by flossly »

streb-lo wrote: post #61
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

Use the desktop or web vault directly, don't use the browser plugin.

How are they clearly less susceptible to a supply chain attack?

Maybe the web vault, but then we do not know when it's compromised (that's the whole idea); so we trust them not to've made a mess...

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#289

Post by saghm »

xvedejas wrote: post #139
mayama wrote: post #112

Earlier quoted context omitted.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw

Does this take into account feature flags when summing LOC? It's common practice in Rust to really only use a subset of a dependency, controlled by compile-time flags.

My experience has been that while there's significant granularity in terms of features, in practice very few people actively go out of their way to prune the default set because the ergonomics are kind of terrible, and whether or not the default feature set is practically empty or pulls in tons of stuff varies considerably. I felt strongly enough about this that I wrote up my only blog post on this a bit over a year ago, and I think most of it still applies: https://saghm.com/cargo-features-rust-compile-times/

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#290

Post by kay_o »

yolo_420 wrote: post #52
1024kb wrote: post #26

Earlier quoted context omitted.

I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.

Not op but I mean you can use a public cloud with Cryptomator on top if you don’t trust your password DB on a non E2E cloud. Or you can just use your own cloud (but then no access outside or can risk and open up infra), and then any of the well known clients on your phone. Can optionally sandbox them if possible and then just be mindful of sync conflicts with the DB file but I assume you, like most people, will 99.9%…

Avoid Onedrive btw - it thinks encrypted files are ransomware; previous use resulted in nonstop ransomware warnings after cryptomator use
Post reply on HN