Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

381–390 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#381

Post by thfuran »

dsl wrote: post #375
pavon wrote: post #347

Earlier quoted context omitted.

A patch updates is a newer version, and they are just as likely to be compromised by supply chain attacks as minor or major updates.

Not exactly. Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced. Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.

No, you create version 1.4.19, which fixes a bug in 1.4.18.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#382

Post by dijit »

embedding-shape wrote: post #129
mayama wrote: post #112

Earlier quoted context omitted.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw

326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal. Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world. Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell.

Why are you talking about compile times in a thread about supply chain security.

326 packages is approximately 326 more packages than I will ever fully audit to a point where my employer would be comfortable with me making that decision (I do it because many eyes make bugs shallow).

It's also approximately 300 more than the community will audit, because it will only be "the big ones" that get audited, like serde and tokio.

I don't see people rushing to audit `zmij` (v1.0.19), despite it having just as much potential to backdoor my systems as tokio does.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#383

Post by NetMageSCW »

wongarsu wrote: post #281
seanw444 wrote: post #267

Earlier quoted context omitted.

That's true. But it does seem like a logic result of having no real standard library. That lone fact has kept me away from Rust for real projects, because I don't want to pull in a bunch of defacto-standard-but-not-officially dependencies for simple tasks. That's probably a large contributor to the current state of dependency bloat.

'no real standard library' doesn't seem entirely fair. Rust has a huge standard library. What it does have is the policy to only include "mature" things with little expected API evolution in the standard libary, which leaves gaping holes where a json parser, a http client or a logging library should be. Those are all those defacto-standard-but-not-officially dependencies

Perhaps that’s just a sign Rust isn’t suitable for those type of projects.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#384

Post by NetMageSCW »

bfivyvysj wrote: post #305
hombre_fatal wrote: post #191

Earlier quoted context omitted.

Node deps are pinned: https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-j... The problem is that you also want to update deps.

Why?

Because they could have a security flaw that might compromise your project or any users of it.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#385

Post by saidnooneever »

some coffee apps will be malicious now with 'melange' as IoC haha.. and Navigator xD... but i guess netscape is kinda malware o.O.

on a more serious note. i told you so levels reaching new heights. dont use password managers. dont handoff this type of risk to a third party.

its like putting all your keys in a flimsy lockbox outside of your appartment. at some point someone will trip over it, find the keys and explore -_-.

it being impractical with the amount of keys/passwords you need to juggle?

not an excuse. problem should and can be solved differently.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#386

Post by jeroenhd »

seanw444 wrote: post #231
elAhmo wrote: post #219

Earlier quoted context omitted.

"326 seems large, but not abnormal" was the state of JS in the past as well. Chance of someone auditing all of them is virtually zero, and in practice no one audits anything, so you are still effectively blindly trusting that none of those 326 got compromised.

It is baffling to me that a language that is as focused on safety/security as Rust decided to take the JavaScript approach to their ecosystem. I find it rather contradictory.

I doubt Microsoft's kernel/system Rust code is pulling in a lot of crates. The Linux kernel sure isn't, and Android's Bluetooth stack doesn't seem to either.

Using crates is a choice. You can write fully independent C++ or you can pull in Boost + Qt + whatever libraries you need. Even for C programs, I find my package manager downloading tons of dependencies for some programs, including things like full XML parsers to support a feature I never plan to use.

Javascript was one of the first languages to highlight this problem with things like left-pad, but the xz backdoor showed that it's also perfectly possible to do the same attack on highly-audited programs written in a system language that doesn't even have a package manager.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#387

Post by iso1631 »

zie wrote: post #89
hgoel wrote: post #13

Does the CLI auto-update? Edit: The CLI itself apparently does not, which will have limited the damage a bit, but if it's installed as a snap, it might. Incidents like this should hopefully cause a rollback of this dumb system of forcefully and frequently updating people's software without explicit consent. Also the time range provided in https://community.bitwarden.com/t/bitwarden-statement-on-che... can help with k…

I think you had to have installed the CLI during that time-frame, then ran the brand new installed CLI to be vulnerable. Assuming you had it already installed, you would be safe.

I checked a machine this morning and it had updated itself at Apr 23 1715G

I've purged the snap. Really should purge snapd completely.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#388

Post by Ferret7446 »

eranation wrote: post #356
neya wrote: post #320

Earlier quoted context omitted.

Stop using Javascript. Or Typescript or whatever excuses they have for the fundamentally flawed language that should have been retired eons ago instead of trying to get it fixed. Javascript, its ecosystem has always been a pack of cards. Time and again it has been proven again. I think this is like the 3rd big attack in the last 30 days alone.

Yes but it has nothing to do with the language, and everything to do with the ecosystem (npm tried to make thing such as mandatory MFA etc, npmjs is so big maintainers pushed back) TypeScript on its own is a great language, with a very interesting type system. Most other type systems can’t run doom. https://simonwillison.net/2025/Feb/27/typescript-types-can-r...

> Most other type systems can’t run doom.

That doesn't sound like a compliment.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#389

Post by Ferret7446 »

embedding-shape wrote: post #129
mayama wrote: post #112

Earlier quoted context omitted.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw

326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal. Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world. Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell.

> 326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal.

That's a damning indictment of Rust. Something as big as Chrome has IIRC a few thousand dependencies. If a simple password manager CLI has hundreds, something has gone wrong. I'd expect only a few dozen

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#390

Post by Ferret7446 »

atdt wrote: post #344
seanw444 wrote: post #231

Earlier quoted context omitted.

It is baffling to me that a language that is as focused on safety/security as Rust decided to take the JavaScript approach to their ecosystem. I find it rather contradictory.

What exactly would you have done differently? Cargo made its debut in 2014, a year before the infamous left-pad incident, and three years before the first large-scale malicious typosquatting attacks hit PyPI and NPM. The risks were not as well-understood then as they are today. And even today it is very far from being a solved problem.

Yet Go is half a decade older and seems to have handled the situation much better.
Post reply on HN