Bitwarden CLI 2026.4.0 compromised in Checkmarx supply chain attack

Bitwarden's CLI npm package version 2026.4.0 was compromised after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline to insert malicious code. The injected code exfiltrated environment secrets and delivered credential-stealing malware through the npm package, enabling attackers to harvest credentials and propagate the malware. Security teams linked the compromise to the broader Checkmarx supply chain campaign, putting CI credentials, encrypted vault contents, and cryptocurrency keys at risk. Organizations using the CLI should treat 2026.4.0 as untrusted, rotate exposed secrets, audit CI workflows, and upgrade to a patched release.