Bitwarden CLI Hijacked in npm Supply Chain Attack Linked to TeamPCP & Checkmarx Breach

Summary of Bitwarden CLI Compromise and Mitigation

Overview: On April 22, the npm package @bitwarden/cli was compromised with a malicious version (2026.4.0) that was active for approximately 90 minutes. This compromised package could steal credentials and propagate through supply chains.

Immediate Actions for Affected Users

1. Uninstall Malicious Package:

   bash
    
   1npm uninstall -g @bitwarden/cli

2. Clean Cache and Disable Scripts:

   bash
    
   1npm cache clean --force
   2npm config set ignore-scripts true

3. Search for Artifacts Left by the Malware:

   bash
    
   1rg -n "audit.checkmarx.cx|LongLiveTheResistanceAgainstMachines|beautifulcastle" .
   2ls -la bun bun.exe bw1.js bw_setup.js 2>/dev/null

4. Rotate Credentials:

   • Revoke all GitHub personal access tokens and re-authenticate.
   • Rotate npm publish tokens, especially those used in CI/CD pipelines.
   • Audit AWS access keys and SSM Parameter Store

Read the full article at SOCRadar-? Cyber Intelligence Inc.

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.