everyone missed this. a few days ago, bitwarden cli (one of the biggest password managers) was backdoored on npm.


live for 93 minutes. 334 devs installed it before anyone noticed.
how it happened:
> attackers hijacked a bitwarden engineer's github account
> pushed a malicious version of the npm package (@bitwarden/cli@2026.4.0).
> anyone who ran npm install bitwarden/cli during that window pulled the backdoor.
the install script didn't ship the malware directly. it downloaded the bun runtime from github's official release endpoint, so the network traffic looked 100% legitimate. bun then executed the real payload, bw1.js.
what got stolen:
> npm tokens
> github tokens
> ssh keys
> aws / gcp / azure credentials
> contents of .env files
> mcp config files from claude code and codex cli (yes, ai assistant secrets are now part of the loot)
post-image
post-image
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin