Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain

Socket caught @bitwarden/cli 2026.4.0 on npm shipping a malicious bw1.js payload on April 23, 2026, pushed via a compromised GitHub Action in Bitwarden’s CI/CD pipeline. It is the same playbook as the broader Checkmarx campaign: same gzip+base64 packaging, same audit.checkmarx[.]cx/v1/telemetry C2 (IP 94.154.172.43, lockfile /tmp/tmp.987654321.lock). The stealer scrapes GitHub tokens from memory and harvests AWS/Azure creds, npm config, SSH keys and (charmingly modern) Claude/MCP configuration data, then exfils through GitHub API and npm registry channels. Bitwarden’s statement puts the malicious version on npm between 5:57 PM and 7:30 PM ET on April 22 and reports no evidence that vault data was accessed. Affected users should uninstall it, rotate exposed secrets and move to 2026.4.1; the incident is tracked as CVE-2026-42994. Only the npm CLI was affected (the Chrome extension and other distributions are clean), but “password manager CLI ships a credential stealer” is the kind of headline that ages well.