Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply Chain Campaign — Threadlinqs Intelligence
As of 2026-05-30, Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply Chain Campaign is a critical-severity supply chain threat attributed to TeamPCP (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0417 · Severity: CRITICAL · CVSS: 9.6 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · Russia · ESPIONAGE
Attackers published @bitwarden/cli version 2026.4.0 to npm with an embedded malicious loader (bw1.js) after abusing a compromised GitHub Action in Bitwarden's CI/CD pipeline, extending the March-April
On 2026-04-23 Socket Security disclosed that @bitwarden/cli 2026.4.0, published to the npm registry hours earlier, contained a malicious file bw1.js whose tradecraft and infrastructure match the broader Checkmarx supply chain compromise disclosed one day prior (2026-04-22). The npm package tarball is the only affected distribution — the Bitwarden browser extension, desktop app, mobile app, MCP server, and self-hosted server are unaffected. The intrusion vector is a compromised GitHub Action referenced by Bitwarden's CI/CD release pipeline; when the tagged action resolved to attacker-controlled code, it injected bw1.js into the published tarball and uploaded the build to npm through the legitimate maintainer identity, defeating normal release attestation.
The bw1.js loader is written in JavaScript and is a multi-stage artifact: it contains gzip+base64-encoded embedded resources including a Python memory-scraping routine, a setup.mjs staged loader, a GitHub Actions workflow YAML (format-check.yml) for downstream secret exfiltration, a hardcoded RSA public key, and a textual manifesto referencing the Butlerian Jihad and Shai-Hulud. On execution the loader downloads Bun v1.3.13 from the official oven-sh/bun GitHub releases (living-off-the-land — the runtime is a benign binary) and uses it to execute the decoded stages. A Russian-locale kill switch (`LANG`, `LC_ALL`, `LANGUAGE`) and a lock file at /tmp/tmp.987654321.lock gate execution.
Once running, the malware enumerates credentials on the host: GitHub tokens scraped directly from Runner.Worker process memory as well as from environment variables and gh auth token; AWS credentials from ~/.aws; Azure tokens via az account get-access-token; GCP configuration via gcloud config config-helper; npm tokens from ~/.npmrc; SSH private keys; and Claude/MCP configuration files — a notable new target reflecting the rise of AI developer tooling. Stolen data is packaged into a JSON envelope, encrypted with the embedded RSA key, and exfiltrated two ways: (1) an HTTPS POST to https://audit.checkmarx[.]cx/v1/telemetry (resolved to 94.154.172.43) whose URL is obfuscated in the binary via a __decodeScrambled routine seeded with 0x3039; and (2) a GitHub API commit that creates a new repository under the victim's account following a Dune-themed naming pattern ({word}-{word}-{3digits}, e.g., gesserit-melange-813, prescient-sandworm-556, fedaykin-phibian-527, atreides-thumper-424) containing a results/ folder with fields {envelope, key, token} and the unique marker string LongLiveTheResistanceAgainstMachines.
Propagation is worm-like. Using harvested npm tokens, the malware queries the npm registry for packages the victim has publish rights to, mutates package.json to add a preinstall hook that re-runs bw1.js, and republishes those packages — extending the blast radius well beyond Bitwarden's own dependency graph. The workflow-injection stage writes .github/workflows/format-check.yml into target repositories containing `env: VARIABLE_STORE: ${{ toJSON(secrets) }}` and uploads the serialized secret store as a workflow artifact, siphoning every secret configured at repo and org scope. Persistence on developer workstations is established through ~/.bashrc and ~/.zshrc injection so that subsequent shells re-execute the loader.
Infrastructure, hashes (mcpAddon.js SHA256 24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9; trojanized KICS ELF SHA256 2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50), and the audit.checkmarx[.]cx C2 are shared with the earlier Checkmarx KICS Docker Hub compromise (malicious tags v2.1.20, v2.1.20-debian, v2.1.21, v2.1.21-debian, alpine, debian, latest) and the trojanized cx-dev-assist (1.17.0, 1.19.0) and ast-results (2.63.0, 2.66.0) VS Code extensions — indicating a common operator or toolkit. Attribution to TeamPCP (aka @pcpcats) is suggested by the shared tooling and their public taunting of the Checkmarx incident, but the Shai-Hulud/Butleria
Weaknesses (CWE)
CWE-506, CWE-829, CWE-1357, CWE-494, CWE-798
Target sectors: technology, software-development, devops, financial, government, healthcare, msp, cloud-service-providers, open-source-projects
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195.002, T1199, T1059.007, T1059.006, T1204.002, T1546.004, T1554, T1027, T1480.001, T1036