Malicious Bitwarden CLI Package on npm Compromised Developer Systems for 93 Minutes

On April 22, 2024, a malicious version of Bitwarden’s command-line interface (CLI) was published to npm under the official package name @bitwarden/[email protected]. For 93 minutes, anyone installing the package via npm received a compromised substitute instead of the legitimate tool.

Bitwarden detected the breach, removed the malicious package, and issued a statement confirming that no evidence of end-user vault data access or production system compromise was found. Security research firm JFrog analyzed the payload and discovered that the malware was not designed to target Bitwarden vaults. Instead, it focused on stealing high-value credentials that govern infrastructure access and automation workflows.

Credentials Targeted by the Malicious Bitwarden CLI

Bitwarden serves over 50,000 businesses and 10 million users, and its documentation describes the CLI as a “powerful, fully-featured” tool for accessing and managing vaults, including in automated workflows that authenticate using environment variables. Bitwarden recommends npm as the simplest and preferred installation method for users already familiar with the registry.

This combination—heavy automation use, installation on developer machines, and official distribution via npm—places the CLI in a position where it interacts with high-value infrastructure secrets, making it an attractive target for supply chain attacks.

How the Malicious Payload Operated

JFrog’s analysis revealed that the malicious package rewired both the preinstall hook and the bw binary entrypoint to a loader. This loader fetched the Bun runtime and launched an obfuscated payload. The compromise was triggered both at install time and runtime.

An organization could run the backdoored CLI without accessing stored passwords, while the malware systematically collected credentials governing CI pipelines, cloud accounts, and deployment automation. This allowed attackers to gain persistent access to critical infrastructure without triggering immediate suspicion.

Root Cause Linked to Compromised CI/CD Pipeline

Security firm Socket reported that the attack appears to have exploited a compromised GitHub Action in Bitwarden’s CI/CD pipeline. This aligns with a pattern identified by researchers at Checkmarx, who have been tracking a broader supply chain campaign. Bitwarden later confirmed that the incident was connected to this campaign.

The incident underscores the vulnerabilities in the npm ecosystem’s trusted publishing model. Traditionally, npm relied on long-lived publish tokens, which posed significant risks if compromised. To mitigate such threats, npm has shifted toward OIDC-based CI/CD authentication, a system designed to reduce reliance on static credentials and lower the risk of supply chain attacks.