Bitwarden

Disclosed Apr 23, 2026Unverified

Bitwarden CLI npm release trojanized to steal developer credentials

Version 2026.4.0 of the @bitwarden/cli npm package was published with credential-stealing code after a compromised GitHub Action in Bitwarden's CI pipeline, harvesting GitHub, npm and cloud tokens and SSH keys. Only the npm CLI was affected.

What is known

People affected	Not stated in the sources we have
Disclosed	Apr 23, 2026
Attack	Supply chain
Data exposed	Credentials and tokensAPI keys
Sector	Tech · US
Status	Unverified: not yet confirmed by an official notice, a filing or the organization

Sources

Newssocket.dev

Bitwarden CLI compromised

Newsbleepingcomputer.com

Bitwarden CLI npm package compromised to steal developer credentials

Notices filed

TotalApr 23

ResearchCount not stated

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about Bitwarden