For 93 minutes, installing Bitwarden’s ‘official’ CLI turned laptops into launchpads for hijacking GitHub accounts
CryptoSlate
A malicious version of Bitwarden's CLI on npm exposed developer credentials and infrastructure secrets for 93 minutes during a supply chain attack.Summary
For 93 minutes on April 22, a backdoored version of Bitwarden’s command-line interface was distributed via the official npm registry. Security firm JFrog discovered that the malware targeted developer environments to harvest sensitive credentials, including GitHub tokens, AWS and GCP keys, and SSH credentials, rather than accessing Bitwarden vaults directly. Bitwarden confirmed the breach was part of a larger supply chain campaign linked to compromised GitHub Actions, emphasizing that even 'official' packages can pose severe risks if the underlying release workflows are compromised.
(Source：CryptoSlate)