Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign • Hacker News Board

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#111

Post by QuantumNomad_ » Thu, Apr 23, 2026, 4:14 PM UTC

embedding-shape wrote: post #80

QuantumNomad_ wrote: post #68

Earlier quoted context omitted.

The 1Password mobile and desktop apps have such a nice UX that I’m happy copy pasting from and into it instead of having any of the browser extensions enabled. I have 1Password configured to require password to unlock once per 24 hours. Rest of the time I have it running in the background or unlock it with TouchID (on the MacBook Pro) or FaceID (on the iPhone). It also helps that I don’t really sign into a ton of ser…

> The 1Password mobile and desktop apps have such a nice UX that I’m happy copy pasting from and into it instead of having any of the browser extensions enabled. Also a great way of missing out on one of the best protections of password managers; completely eliminating phishing even without requiring thinking. And yes, still requires you to avoid manually copy-pasting without thinking when it doesn't work, but so muc…

In Safari on iOS I have all the main pages I use as favourites, so that they show on the home screen of Safari.

Likewise I have links in the bookmarks bar on desktop.

I use these links to navigate to the main sites I use. And log in from there.

I don’t really need to think that way either.

But I agree that eliminating the possibility all-together is a nice benefit of using the browser integration, that I am missing out on by not using it.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#112

Post by mayama » Thu, Apr 23, 2026, 4:15 PM UTC

pregnenolone wrote: post #91

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

Well.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others.

https://lib.rs/crates/rbw

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#113

Post by reactordev » Thu, Apr 23, 2026, 4:16 PM UTC

cobolcomesback wrote: post #107

stvnbn wrote: post #95

Earlier quoted context omitted.

I love how the first comment is a complain having nothing to do with the actual subjec

Not to mention utter nonsense. There’s no possible way that BW CLI somehow injected command history into a remote server. That was 100% something the GP did, a bug in their terminal, or a config they have with ssh/tmux, not Bitwarden.

that's our future... with AI. Engineers that don't know the difference between client-side convenience and server-side injection, how to configure `php.ini`, or that no synchronized password manager is safe. While the OAuth scope is `*`, and CORS is what you drink on the weekend.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#114

Post by ufmace » Thu, Apr 23, 2026, 4:17 PM UTC

brightball wrote: post #48

zerkten wrote: post #43

Earlier quoted context omitted.

Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.

The problem is that the UX with a browser extension is so much better.

Importantly IMO is the extra phishing protection that the UX is really nice if and only if the url matches what's expected. If you end up on a fake url somehow, it's a nice speed bump that it doesn't let you auto-fill to make you think, hold on, something is wrong here.

If you're used to the clunkier workflow of copy-pasting from a separate app, then it's much easier to absent-mindedly repeat it for a not-quite-right url.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#115

Post by epistasis » Thu, Apr 23, 2026, 4:17 PM UTC

stvnbn wrote: post #95

1024kb wrote: post #7

I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of…

I love how the first comment is a complain having nothing to do with the actual subjec

Password managers are all about trust, the main link is about a compromise, so it's not surprising that the first comment is also about trust too, even if it's not directly about this particular compromise.

I found the default bwcli clunky and unacceptable, and it's why I don't use it, even though I still have a BitWarden subscription.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#116

Post by Barbing » Thu, Apr 23, 2026, 4:17 PM UTC

tracker1 wrote: post #64

brightball wrote: post #48

Earlier quoted context omitted.

The problem is that the UX with a browser extension is so much better.

I also find it far easier to resist accidentally entering credentials in a phishing site... I'm pretty good about checking, but it's something I tend to point out to family and friends to triple check if it doesn't auto suggest the right site.

I’m impressed with their feature to add the URL for next time, after manually filling on an unmatched URI. Hairs raised on neck clicking confirm though.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#117

Post by gear54rus » Thu, Apr 23, 2026, 4:18 PM UTC

rvz wrote: post #63

gear54rus wrote: post #35

Earlier quoted context omitted.

The above comment is just a bunch of generalizations not meant to address seriously that's why.

So the comparison here is that you would rather trust a password manager with a CLI that imports hundreds of third-party dependencies over a first party password manager with a CLI that comes with the OS? I don't think macOS Keychain uses NPM and it isn't in TypeScript or Javascript and, yes it does not need a CLI either. The NPM and Java/Typescript ecosystem is part of the problem that encourages developers to impor…

It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship.

JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#118

Post by hootz » Thu, Apr 23, 2026, 4:19 PM UTC

kelvinjps10 wrote: post #98

mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

the only thing I can't find to do with keepass is how back up it in the cloud, like if you encrypt your back up, then where do you save that password, then where do you save the password for the cloud provider?.

You save the single password in your head. All other passwords go inside Keepass.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#119

Post by Vvector » Thu, Apr 23, 2026, 4:20 PM UTC

pixel_popping wrote: post #86

post-it wrote: post #81

I've dramatically decreased my reliance on third-party packages and tools in my workflow. I switched from Bitwarden to Apple Passwords a few months ago, despite its worse feature set (though the impetus was Bitwarden crashing on login on my new iPad). I've also been preferring to roll things on my own in my side projects rather than pulling a package. I'll still use big, standalone libraries, but no more third-party…

Why not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?

Seamless syncing is the primary reason I stick with BW

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#120

Post by antiframe » Thu, Apr 23, 2026, 4:21 PM UTC

jasonjayr wrote: post #36

piperswe wrote: post #32

Earlier quoted context omitted.

Syncthing can synchronize Keepass files between devices quite well.

I rely on this too, but counting down the days android no longer lets syncthing touch another app's files :(

I never enjoyed the Android syncthing experience, so I just plug my phone in once a month and manually copy the vault over. I don't ever edit on my phone, so I don't need two-way syncing.