Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.
Bitwarden CLI 2026.4.0 (2026-04-22T21:57Z to 2026-04-22T23:30Z)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC: Conceptual check for the malicious Bitwarden CLI version
// This script simulates checking the installation timestamp and version.
const fs = require('fs');
const path = require('path');
// Simulate checking package.json
const packagePath = path.join('node_modules', '@bitwarden', 'cli', 'package.json');
try {
const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
console.log(`[+] Detected Bitwarden CLI Version: ${pkg.version}`);
// Check if version matches the vulnerable range
if (pkg.version === '2026.4.0') {
console.log("[!] WARNING: Version 2026.4.0 is potentially compromised.");
console.log("[!] Malicious code may be embedded.");
// Concept: The malicious code typically exfiltrates data or opens a shell.
// In a real scenario, one would monitor outbound traffic or file modifications.
} else {
console.log("[-] Version does not match the known compromised range.");
}
} catch (e) {
console.log("[-] Bitwarden CLI not found or error reading package.json.");
}