Bitwarden CLI Compromised After Malicious GitHub Actions Workflow

Cybersecurity researchers at Socket have uncovered a major supply chain compromise affecting the Bitwarden CLI.

Attackers successfully abused a GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code into the popular password manager’s npm package. This breach is part of the broader, ongoing Checkmarx supply chain campaign.

Bitwarden CLI Compromised

The compromised package, identified as @bitwarden/cli version 2026.4.0, contains a malicious payload hidden in a file named bw1.js, as reported by Socket.

Currently, the breach only impacts the npm package for the command-line interface. Bitwarden’s Chrome extension and other legitimate distributions remain secure.

This malware shares core infrastructure with the recent Checkmarx attacks, communicating with the same command-and-control endpoint. Once executed, the script becomes an aggressive credential-harvester.

It scrapes memory and environment variables to steal GitHub tokens, cloud credentials for AWS, Azure, and GCP, npm configuration files, and SSH keys.

While sharing infrastructure with the Checkmarx campaign, this specific payload features several distinct and unusual behaviors.

Most notably, the malware includes a Russian locale kill switch. It will silently exit without executing if the system locale or any environment variable begins with “ru”.

The attackers also embedded explicit ideological branding themed around the sci-fi franchise Dune. Stolen data is exfiltrated by automatically creating public GitHub repositories under the victim’s account.

These repositories use Dune-themed naming conventions, combining random words with specific terms like “fremen,” “sandworm,” or “mentat.”

Furthermore, the repository descriptions feature phrases like “Shai-Hulud: The Third Coming” alongside an embedded “Butlerian Jihad” manifesto.

To maintain persistence on infected developer machines, the payload injects itself into shell profiles. It also uses a hardcoded lock file to prevent multiple malware instances from running simultaneously.

Mitigation Steps for Developers

Organizations using the Bitwarden npm package must treat this as a severe CI/CD compromise and credential exposure event. Security teams should take immediate action to secure their environments.

• Remove the affected @bitwarden/cli package from all developer systems and build pipelines immediately.
• Rotate all potentially exposed secrets, including GitHub tokens, cloud platform credentials, npm tokens, and SSH keys.
• Audit GitHub environments for unauthorized repository creation, especially those containing Dune-related keywords or unexpected workflow files.
• Inspect npm repositories for unauthorized publishes or injected preinstall hooks, as the malware attempts to steal npm tokens to propagate itself further.
• Monitor network logs for outbound connections to unusual infrastructure or unexpected access to cloud credential stores.
• Enhance long-term security by locking down token scopes, requiring short-lived credentials, and hardening GitHub Actions permissions to limit the blast radius of future incidents.

IOCs

Malicious Package

• @bitwarden/cli2026.4.0

Network Indicators

• 94[.]154[.]172[.]43
• https://audit.checkmarx[.]cx/v1/telemetry

File System Indicators (Victim Package Compromise)

• /tmp/tmp.987654321.lock
• /tmp/_tmp_<Unix Epoch Timestamp>/
• package-updated.tgz

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.