Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

451–458 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#451

Post by akimbostrawman »

neobrain wrote: post #392
akimbostrawman wrote: post #373

Earlier quoted context omitted.

Browser password manager extensions are like putting a dog door on your reinforced vault door. Giant increase in attack surface.

Quite the contrary, actually: not using a browser extension makes you much more susceptible to phishing attacks, since your password manager won't be able to protect you from copy-pasting credentials into an imposter website.

You don't need any of that to protect against phishing. Simply bookmark the website once and only use the bookmark to go to the site.

Browser password extension are just percieved convinence over security.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#452

Post by akimbostrawman »

Capricorn2481 wrote: post #421
akimbostrawman wrote: post #373

Earlier quoted context omitted.

Browser password manager extensions are like putting a dog door on your reinforced vault door. Giant increase in attack surface.

Well we're in a thread about the CLI being compromised. I've never heard of a sandboxed browser extension being compromised.

You don't need to compromise the extension but that sure is another drawback of installing more software than actually needed. You could exploit the password manager extension from inside the browser and that way get access to the password manager since you created a direct path to it weakening the otherwise strong browser security.

The browser should stay isolated and seperate from anything on the device instead of integrating "dog doors" in the software with the no1 biggest attack surface of any modern device.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#453

Post by pdimitar »

mayama wrote: post #438
pdimitar wrote: post #411

Earlier quoted context omitted.

How does it handle better, exactly?

You can write simple http server or rest client with stdlib in Go. No need to include tokio, serde and hundred other cargos which constantly break things. I have apps written in Go more than a decade ago work the same now with recent version of Go. Where as, I had issues with getting few year old github apps in rust compiling and working in rust.

I know what you mean about Go vs. Rust here and I've seen it firsthand, though I believe the effect is overblown. I was able to modernize a fairly old project in literal 15 minutes by using Cargo Clippy's fix mode + a few small hand-crafted changes.

To me a rich stdlib is not a selling point. Both ecosystems have a ton of very high-quality libraries.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#454

Post by array_key_first »

mort96 wrote: post #282
embedding-shape wrote: post #257

Earlier quoted context omitted.

That's because you're mixing things. "Rust the language" isn't the one starting new projects and add new dependencies that have hundreds of dependencies of their own, this is the doing of developers. The developers who built Rust with a focus on safety and security is not the same developers mentioned before.

Rust and Cargo are, if not inseparable, at least tightly connected. Rust and Rust's stdlib are inseparable. Cargo is modeled after NPM. It works more or less identically, and makes adding thousands of transient dependencies effortless, just like NPM. Rust's stdlib is pretty anemic. It's significantly smaller than node's. These are decisions made by the bodies governing Rust. It has predictable results.

Rust's stdlib is fine, it's similar to C++ and C++ never had this problem.

It's just that it you give developers tools, they will absolutely abuse them to the highest extent. The problem with cargo is it's too good, so of course devs are gonna be pulling hundreds of dependencies. It's also why things like Claude Code have so much potential for shitty outcomes. Developers are lazy to the n-th degree. In fact, being a developer is predicated on being lazy. Laziness is the whole motivation behind software!

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#455

Post by salt6763 »

xienze wrote: post #133
1024kb wrote: post #26

Earlier quoted context omitted.

I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.

I use self-hosted Bitwarden (Vaultwarden) for this. It runs on my local network, and I have it installed on my phone etc. When I’m on my local network, everything works fine. When I’m not on my local network, the phone still has the credentials from the last time it was synced (i.e., last time it was used while the phone was on the home network). It’s a pretty painless way to keep things in sync without ever allowing…

Bitwarden does not let you create credentials while not connected to a server. Its a "read only" copy.

There is an alternative client called keyguard that allows you to create or modify credentials, then sync to the server later.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#456

Post by eranation »

johntash wrote: post #444
eranation wrote: post #144

Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the 334 unlucky people who downloaded the malicious @bitwarden/cli 2026.4.0, published ~19+ hours ago (see https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi... and select "show deprecated vers…

> https://depsguard.com if anyone is interested. I really appreciate that you didn't include a "curl | bash" command to paste for installing, but at the same time it's what I was expecting when I clicked. I'm pretty sure I saw a comment on HN where the user wrapped all of their npm/pip/etc commands with bubblewrap. I've been thinking of doing something similar and basically just seeing how many of my daily commands I…

Yeah, I really wanted to avoid anything "| bash"... appreciate you noticed! (although downloading any binary is also risky, I think just making this a standalone python script would be a better idea for the next version)

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#457

Post by kelvinjps10 »

eipi10_hn wrote: post #182
kelvinjps10 wrote: post #98

Earlier quoted context omitted.

the only thing I can't find to do with keepass is how back up it in the cloud, like if you encrypt your back up, then where do you save that password, then where do you save the password for the cloud provider?.

Same as Bitwarden? You just need to remember Keepass password, just like remember Bitwarden password.

no, I mean, for example, I save my backups in Backblaze S3 buckets, with rclone, there is the Backblaze password, the rclone password for the backups, and finally the password for keepass itself. Where do I save the 2 previous password, I either have to memorize all 3. Or make it the same password for all of them. For bitwarden I only need to know the master password itself. if I want to have cloud backups

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#458

Post by kelvinjps10 »

hootz wrote: post #118
kelvinjps10 wrote: post #98

Earlier quoted context omitted.

the only thing I can't find to do with keepass is how back up it in the cloud, like if you encrypt your back up, then where do you save that password, then where do you save the password for the cloud provider?.

You save the single password in your head. All other passwords go inside Keepass.

so for example I use backblaze bucket or whatever, just use the same password as keepass?
Post reply on HN