Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

431–440 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#431

Post by martin- »

pprotas wrote: post #215
harshreality wrote: post #131

Earlier quoted context omitted.

It's crazy because it's not default bw behavior, or even any bw behavior... I don't use the cli, but I don't see any built-in capacity to copy bw output to the clipboard. (In the UNIX way, you'd normally pipe it to a clipboard utility if you wanted it copied, and then the security consequences are on you.) They probably caused it themselves, somehow, and then blamed bitwarden. Note in the original comment they aren't…

`bw list` shows plaintext credentials in the CLI https://bitwarden.com/help/cli/#list I know this because I had the same surprised reaction

No one is disputing that part. It's the "copied into clipboard automatically" part that sounds implausible.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#433

Post by latexr »

pdimitar wrote: post #430
latexr wrote: post #429

Earlier quoted context omitted.

I’m not the person you asked, but given the choice I avoid a language without JSON parsing officially supported because I need that frequently. It’s the reason I never picked up Lua, despite being interested in it.

Interesting, thanks for sharing your anecdote. Upvoted. I am openly admitting I don't care. Such libraries are in a huge demand and every programming language ecosystem gains them quite early. So to me the risk of malicious code in them is negligibly small.

To me it’s not just the risk of malicious code, but also convenience. For example, if I’m using a scripted language and sharing it in some form with users, I don’t want to have to worry about keeping the library updated, and fight with the package manager, and ship extraneous files, and…

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#434

Post by pdimitar »

latexr wrote: post #433
pdimitar wrote: post #430

Earlier quoted context omitted.

Interesting, thanks for sharing your anecdote. Upvoted. I am openly admitting I don't care. Such libraries are in a huge demand and every programming language ecosystem gains them quite early. So to me the risk of malicious code in them is negligibly small.

To me it’s not just the risk of malicious code, but also convenience. For example, if I’m using a scripted language and sharing it in some form with users, I don’t want to have to worry about keeping the library updated, and fight with the package manager, and ship extraneous files, and…

Ah, I don't work with scripting languages though. I understand the difference in usages. Your use-case is quite valid.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#435

Post by dimitry12 »

From Bitwarden official statement: https://community.bitwarden.com/t/bitwarden-statement-on-che...

"a malicious package that was briefly distributed"

"investigation found no evidence that end user vault data was accessed or at risk"

"The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data."

"Users who did not download the package from npm during that window were not affected."

Downplaying so hard it's disgusting. Bitwarden failed and became a vector of attack. A vendor who is responsible for all my passwords. What a joke. All trust lost: by the incident and comms-style. Time to move before they make an even bigger mistake.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#437

Post by b40d-48b2-979e »

ozgrakkurt wrote: post #88

Their website is also incredibly bad. I am not paying for it so it might be better for paying users. It is mind boggling how an app that just lists a bunch of items can be so bloated.

"just lists a bunch of items" describes most apps and is incredibly reductive.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#438

Post by mayama »

pdimitar wrote: post #411
Ferret7446 wrote: post #390

Earlier quoted context omitted.

Yet Go is half a decade older and seems to have handled the situation much better.

How does it handle better, exactly?

You can write simple http server or rest client with stdlib in Go. No need to include tokio, serde and hundred other cargos which constantly break things. I have apps written in Go more than a decade ago work the same now with recent version of Go. Where as, I had issues with getting few year old github apps in rust compiling and working in rust.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#439

Post by rvz »

gear54rus wrote: post #117
rvz wrote: post #63

Earlier quoted context omitted.

So the comparison here is that you would rather trust a password manager with a CLI that imports hundreds of third-party dependencies over a first party password manager with a CLI that comes with the OS? I don't think macOS Keychain uses NPM and it isn't in TypeScript or Javascript and, yes it does not need a CLI either. The NPM and Java/Typescript ecosystem is part of the problem that encourages developers to impor…

It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically. If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship. JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there…

> It does not much matter if it imports 300 or 30 of them, those vulns will land somewhere in those 30 with equal frequency statistically.

The point is the risk is far higher with more dependencies as I said from the very start. But it happens much more frequently in the NPM ecosystem than in others.

> If you are advocating developing without dependencies at all, then please start (with any language) and show us all how much you actually ship.

The languages in the former (especially Go) encourages you to use the standard library when possible. Javascript / TypeScript does not and encourages you to import more libraries than you need.

> JS is a target of these dumb accusations because it's literally the best cross-platform way to ship apps. Stop inventing issues where there are none.

Nope. It is a target because of the necessity for developers to import random packages to solve a problem due to its weak standard library and the convenience that comes with installing them.

You certainly have a Javascript bias towards this issue yourself and there is clearly a problem and you ignoring it just makes it worse.

If it wasn't an issue, we would not be talking about yet another supply chain attack in the NPM ecosystem.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#440

Post by zhenjing »

I made a scanner(ActionPin) for the workflow patterns this compromise exposed.

ActionPin — a GitHub Actions hardening checker that flags unpinned third-party actions, overbroad workflow permissions, install scripts that touch secrets, and agent-triggered jobs that can reach production credentials. ActionPin host on github.

Post reply on HN