AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Bitwarden CLI password manager trojanized in supply chain attack

highnews

security

Source: CSO OnlineApril 23, 2026

Summary

A malicious version of Bitwarden CLI (the terminal interface for a popular password manager) was published to npm by attackers who compromised Bitwarden's CI/CD pipeline (the system that automates building and releasing software). The fake version 2026.4.0 contained malware designed to steal developer credentials like GitHub tokens, AWS keys, and API keys from infected systems, though it was detected and removed within 1.5 hours.

Solution / Mitigation

Users who installed the malicious version 2026.4.0 should uninstall it, clear the npm cache, and delete bw1.js and bw_setup.js from their system. Then they should: revoke all GitHub PATs (personal access tokens, which are authentication credentials), rotate npm tokens and CI publishing tokens, rotate AWS access keys and review SSM and Secrets Manager access, review Azure Key Vault audit logs and rotate affected secrets, review GCP Secret Manager access logs and rotate affected secrets, inspect GitHub Actions workflows and repository artifacts for unauthorized activity, and review shell history and AI tooling configuration files for sensitive data leakage.