Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

Post by mayama » Fri, Apr 24, 2026, 1:31 AM UTC

koyote wrote: post #278

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

I wonder if this is going to push more software to stacks like .Net where you can do most things with zero third-party dependencies. Or, conversely, encourage programming languages to increase the number of features in their standard libraries.

Post by nathanmills » Fri, Apr 24, 2026, 1:38 AM UTC

prmoustache wrote: post #283

gck1 wrote: post #276

Earlier quoted context omitted.

How do you autofill from your db then?

I don't autofill. It may be less user friendly but it is not that big of a deal.

Post by nathanmills » Fri, Apr 24, 2026, 1:42 AM UTC

prmoustache wrote: post #251

gbalduzzi wrote: post #148

Earlier quoted context omitted.

I don't understand how this solves the issue in this case. Bitwarden vaults were not compromised, there was a problem in a tool you used to access the secrets. What makes it impossible for KeePass access tools to have these issues?

> I don't understand how this solves the issue in this case. I'd say since it is a local only tool, you don't really need to update it constantly provided you are a sane person that don't use a browser extension. It makes it easier to audit and yourself less at risk of having your tool compromised. It doesn't have to be keypass though, it can be any local password management tool like pass[1] or its guis or simply a…

Post by saghm » Fri, Apr 24, 2026, 1:44 AM UTC

hsbauauvhabzb wrote: post #326

saghm wrote: post #319

Earlier quoted context omitted.

I'm guessing you meant to respond to the sibling comment rather than mine

Yes, weirdly enough at the time there was no reply button, I thought HN comments had a maximum nested depth, but now it has a reply button and so does yours. Weird.

Post by nathanmills » Fri, Apr 24, 2026, 2:01 AM UTC

mort96 wrote: post #282

embedding-shape wrote: post #257

Earlier quoted context omitted.

That's because you're mixing things. "Rust the language" isn't the one starting new projects and add new dependencies that have hundreds of dependencies of their own, this is the doing of developers. The developers who built Rust with a focus on safety and security is not the same developers mentioned before.

Rust and Cargo are, if not inseparable, at least tightly connected. Rust and Rust's stdlib are inseparable. Cargo is modeled after NPM. It works more or less identically, and makes adding thousands of transient dependencies effortless, just like NPM. Rust's stdlib is pretty anemic. It's significantly smaller than node's. These are decisions made by the bodies governing Rust. It has predictable results.