Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

Post by zie » Thu, Apr 23, 2026, 11:15 PM UTC

Yolopix wrote: post #275

zie wrote: post #178

Earlier quoted context omitted.

I have family I need to support, so I use 1password. It also helped that work gives me a 1P family plan free. The practical differences to me: * 1P is aimed at non-tech users more than Bitwarden. * 1P lets you easily store things other than just passwords (serial #'s, license info, SSN's, etc) You can in Bitwarden, but it's a little annoying. * 1P lets you store SSH keys(by effectively being an ssh-agent): https://de…

Bitwarden can also act as an ssh-agent: https://bitwarden.com/help/ssh-agent/

Post by saghm » Thu, Apr 23, 2026, 11:20 PM UTC

yangikan wrote: post #266

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

Is there any downside to using the firefox builtin password manager?

Post by saghm » Thu, Apr 23, 2026, 11:27 PM UTC

koyote wrote: post #278

ruuda wrote: post #51

https://github.com/doy/rbw is a Rust alternative to the Bitwarden CLI. Although the Rust ecosystem is moving in NPM's direction (very large and very deep dependency trees), you still need to trust far fewer authors in your dependency tree than what is common for Javascript.

I wonder if this is going to push more software to stacks like .Net where you can do most things with zero third-party dependencies. Or, conversely, encourage programming languages to increase the number of features in their standard libraries.

Post by skybrian » Thu, Apr 23, 2026, 11:34 PM UTC

abustamam wrote: post #255

eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

I like the idea of a cool down. But my next question is would this have been caught if no one updated? I know in practice not everyone would be on a cool down. But presumably this comprise was only found out because a lot of people did update.

Post by subarctic » Thu, Apr 23, 2026, 11:42 PM UTC

kjok wrote: post #274

abustamam wrote: post #255

Earlier quoted context omitted.

I like the idea of a cool down. But my next question is would this have been caught if no one updated? I know in practice not everyone would be on a cool down. But presumably this comprise was only found out because a lot of people did update.

Cooldown sounds like a good idea ONLY IF these so called security companies can catch these malicious dependencies during the cooldown period. Are they doing this bit or individual researchers find a malware and these companies make headlines?