Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

241–250 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#241

Post by d3Xt3r »

gbalduzzi wrote: post #148
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

I don't understand how this solves the issue in this case. Bitwarden vaults were not compromised, there was a problem in a tool you used to access the secrets. What makes it impossible for KeePass access tools to have these issues?

It's not impossible, but most KeePass tools are written in sane languages and built with sane tooling, and don't use trash like Javascript and npm. Of course I'm not considering browser extensions or exclusive web-clients, but the main KeePass client has a good autotype system, so you don't really need to use the browser extension.

In any case, the fact that the official BitWarden client (which uses Electron btw) and even the CLI is written in Javascript/Typescript - should tell you everything you need to know about their coding expertise and security posture.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#245

Post by MetaWhirledPeas »

PunchyHamster wrote: post #223
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

Don't write anything backend or cli tool in NPM would be good start

Other package managers are magically immune?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#247

Post by c2h5oh »

MetaWhirledPeas wrote: post #245
PunchyHamster wrote: post #223

Earlier quoted context omitted.

Don't write anything backend or cli tool in NPM would be good start

Other package managers are magically immune?

They are not, but npm is uniquely bad in that regard. Refusal to implement security features that would have made attacks like this harder really doesn't help https://github.com/node-forward/discussions/issues/29

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#248

Post by post-it »

pixel_popping wrote: post #236
post-it wrote: post #225

Earlier quoted context omitted.

I hope you're not using KeePassX, it's been unmaintained for years. KeePassXC is only available for Linux, which means I'd need to use a third-party app for Mac and iOS, so I'd be trusting three vendors instead of one. Aside from passwords, I store passkeys, secure notes, and MFA tokens.

KeePassXC is cross-platform, unsure about iOS.

Sorry, you're right, I missed the tabs on top. No iOS support though.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#249

Post by prmoustache »

aborsy wrote: post #134
worble wrote: post #38

Earlier quoted context omitted.

Keepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as long as you can read and write to it, it just works. There are keepass clients for just about everything (keepassxc for desktops, keepass2android or keepassdx for android, keepassium for iphone).

How is the quality of browser extensions compared to Bitwarden?

You don't use a browser extension if you are serious about security anyway.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#250

Post by dannyw »

rvz wrote: post #79
nicce wrote: post #47

Earlier quoted context omitted.

I thought that CLI would be efficent when I looked for using it and then I figured it is JavaScript

Exactly. That is the problem. There is a time and place for where it makes sense and a password manager CLI written in TypeScript importing hundreds of third-party packages is a direct red flag. It is a frequent occurrence. We have seen it happen with Axios which is one of the biggest supply chain attacks on the Javascript / Typescript ecosystem and it makes no sense to build sensitive tools with that.

That’s a serious red flag. I’m concerned and I don’t think it shows a security first culture.
Post reply on HN