2026-04-22 · 2026-Q2
Bitwarden CLI npm Package Trojanized via Checkmarx KICS Cascade
Was this approved as what it claims to be?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
@bitwarden/cli npm package version 2026.4.0
Impact
Malicious build of Bitwarden CLI was live on npm for roughly 90 minutes (5:57 PM-7:30 PM ET, April 22, 2026) and pulled approximately 334 times; payload `bw1.js` ran on install and harvested GitHub and npm tokens, SSH keys, AWS, GCP, and Azure secrets, GitHub Actions secrets, AI tooling configuration files, environment variables, and shell history; data exfiltrated to public GitHub repositories created under victim accounts; Bitwarden vault data was not accessed
Root cause
Earlier in the day, attackers compromised the Checkmarx KICS Docker Hub repository; Bitwarden's Dependabot pulled the malicious `checkmarx/kics:latest` image into the Bitwarden CI/CD pipeline, which then signed and published the trojanized CLI; payload contained the marker "Shai-Hulud: The Third Coming" with Dune-themed identifiers
Sources
Catalog
Cite this: AgentProv incident record: Bitwarden CLI npm Package Trojanized via Checkmarx KICS Cascade (2026-04-22). https://agentprov.com/incidents/2026-04-22-bitwarden-cli-npm-package-trojanized-via-checkmarx-kics-cascade
Related
- Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
- Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
- Also L7 · 2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)L7Build / Approval