Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via Abused GitHub Action in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via (TL-2026-0417), also tracked as Bitwarden CLI bw1.js compromise, is a critical-severity supply-chain compromise scored CVSS 9.6, first published 2026-04-23. It is attributed to TeamPCP (Russia) with medium confidence, affects Bitwarden @bitwarden/cli (npm), maps to 21 MITRE ATT&CK techniques (T1003.007, T1027, T1036), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-0417
- Threat ID
- TL-2026-0417
- Also known as
- Bitwarden CLI bw1.js compromise, Checkmarx-Bitwarden supply chain chain, Shai-Hulud npm loader
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-23
- Last reviewed
- 2026-04-23
- Attribution
- TeamPCP
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- technology, software-development, devops, financial, government, healthcare, msp, cloud-service-providers, open-source-projects
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
Malware and tooling: bw1.js loader (Shai-Hulud/Butlerian Jihad variant of Checkmarx campaign toolkit), Bun v1.3.13, Custom Checkmarx-campaign telemetry C2 (audit.checkmarx[.]cx)
Attackers published @bitwarden/cli version 2026.4.0 to npm with an embedded malicious loader (bw1.js) after abusing a compromised GitHub Action in Bitwarden's CI/CD pipeline, extending the March-April 2026 Checkmarx supply chain campaign (TeamPCP) into widely-deployed credential-handling tooling. The payload weaponizes Bun, scrapes Runner.Worker memory for GitHub tokens, harvests cloud/npm/SSH/MCP credentials, persists via shell profile injection, and propagates worm-style by republishing packages the victim can write to via stolen npm tokens. Live exfiltration to audit.checkmarx[.]cx/v1/telemetry (94.154.172.43) and attacker-controlled Dune-themed GitHub staging repositories is ongoing.
How Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via works
On 2026-04-23 Socket Security disclosed that @bitwarden/cli 2026.4.0, published to the npm registry hours earlier, contained a malicious file bw1.js whose tradecraft and infrastructure match the broader Checkmarx supply chain compromise disclosed one day prior (2026-04-22). The npm package tarball is the only affected distribution — the Bitwarden browser extension, desktop app, mobile app, MCP server, and self-hosted server are unaffected. The intrusion vector is a compromised GitHub Action referenced by Bitwarden's CI/CD release pipeline; when the tagged action resolved to attacker-controlled code, it injected bw1.js into the published tarball and uploaded the build to npm through the legitimate maintainer identity, defeating normal release attestation.
The bw1.js loader is written in JavaScript and is a multi-stage artifact: it contains gzip+base64-encoded embedded resources including a Python memory-scraping routine, a setup.mjs staged loader, a GitHub Actions workflow YAML (format-check.yml) for downstream secret exfiltration, a hardcoded RSA public key, and a textual manifesto referencing the Butlerian Jihad and Shai-Hulud. On execution the loader downloads Bun v1.3.13 from the official oven-sh/bun GitHub releases (living-off-the-land — the runtime is a benign binary) and uses it to execute the decoded stages. A Russian-locale kill switch (`LANG`, `LC_ALL`, `LANGUAGE`) and a lock file at /tmp/tmp.987654321.lock gate execution.
Once running, the malware enumerates credentials on the host: GitHub tokens scraped directly from Runner.Worker process memory as well as from environment variables and gh auth token; AWS credentials from ~/.aws; Azure tokens via az account get-access-token; GCP configuration via gcloud config config-helper; npm tokens from ~/.npmrc; SSH private keys; and Claude/MCP configuration files — a notable new target reflecting the rise of AI developer tooling. Stolen data is packaged into a JSON envelope, encrypted with the embedded RSA key, and exfiltrated two ways: (1) an HTTPS POST to https://audit.checkmarx[.]cx/v1/telemetry (resolved to 94.154.172.43) whose URL is obfuscated in the binary via a __decodeScrambled routine seeded with 0x3039; and (2) a GitHub API commit that creates a new repository under the victim's account following a Dune-themed naming pattern ({word}-{word}-{3digits}, e.g., gesserit-melange-813, prescient-sandworm-556, fedaykin-phibian-527, atreides-thumper-424) containing a results/ folder with fields {envelope, key, token} and the unique marker string LongLiveTheResistanceAgainstMachines.
Propagation is worm-like. Using harvested npm tokens, the malware queries the npm registry for packages the victim has publish rights to, mutates package.json to add a preinstall hook that re-runs bw1.js, and republishes those packages — extending the blast radius well beyond Bitwarden's own dependency graph. The workflow-injection stage writes .github/workflows/format-check.yml into target repositories containing `env: VARIABLE_STORE: ${{ toJSON(secrets) }}` and uploads the serialized secret store as a workflow artifact, siphoning every secret configured at repo and org scope. Persistence on developer workstations is established through ~/.bashrc and ~/.zshrc injection so that subsequent shells re-execute the loader.
Infrastructure, hashes (mcpAddon.js SHA256 24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9; trojanized KICS ELF SHA256 2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50), and the audit.checkmarx[.]cx C2 are shared with the earlier Checkmarx KICS Docker Hub compromise (malicious tags v2.1.20, v2.1.20-debian, v2.1.21, v2.1.21-debian, alpine, debian, latest) and the trojanized cx-dev-assist (1.17.0, 1.19.0) and ast-results (2.63.0, 2.66.0) VS Code extensions — indicating a common operator or toolkit. Attribution to TeamPCP (aka @pcpcats) is suggested by the shared tooling and their public taunting of the Checkmarx incident, but the Shai-Hulud/Butlerian Jihad branding embedded in bw1.js diverges from TeamPCP's usual deceptive framing, pointing either to a splinter actor reusing the kit or to an ideological evolution of the campaign. The malicious package has been removed from npm as of disclosure, but because the installer has already run on every CI system and developer machine that resolved 2026.4.0 during the exposure window, credential rotation is mandatory.
MITRE ATT&CK techniques used in TL-2026-0417
Credential Access
T1003.007 OS Credential Dumping: Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1480.001 Execution Guardrails: Environmental Keying
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1614.001 System Language Discovery
Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship
Persistence
T1546.004 Event Triggered Execution: Unix Shell Configuration Modification; T1554 Compromise Host Software Binary
Affected products and versions in Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
- Bitwarden — @bitwarden/cli (npm)
Vulnerable versions: 2026.4.0
Fixed in: 2026.3.x (pre-compromise); 2026.4.1+ (post-incident rebuild, once released) - Checkmarx — KICS Docker image (checkmarx/kics)
Vulnerable versions: v2.1.20; v2.1.20-debian; v2.1.21; v2.1.21-debian; alpine; debian; latest
Fixed in: clean rebuild pending - Checkmarx — cx-dev-assist (VS Code / OpenVSX extension)
Vulnerable versions: 1.17.0; 1.19.0
Fixed in: 1.18.0; post-1.19.0 clean rebuild - Checkmarx — ast-results (VS Code extension)
Vulnerable versions: 2.63.0; 2.66.0
Fixed in: clean rebuild pending
Remediation for Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
Patches
- Use @bitwarden/cli >= 2026.4.1 once Bitwarden republishes a clean release signed from a hardened pipeline
- Until a clean release exists, install Bitwarden CLI from the official standalone distributions (GitHub Releases, Homebrew, Chocolatey, Snap) where artifact hashes can be independently verified
Immediate actions
- Remove @bitwarden/cli 2026.4.0 from all developer workstations, CI runners, container images, and Dockerfiles; pin to last-known-good 2026.3.x
- Treat any machine that installed 2026.4.0 as compromised and rotate every credential the host had access to: GitHub PATs and fine-grained tokens, GitHub Actions OIDC trust, npm automation tokens, AWS access keys, Azure service principal secrets, GCP service account keys, SSH private keys, and Claude/MCP API keys
- Invalidate and re-issue GitHub Actions secrets and organization secrets; audit workflow runs from the exposure window for artifact uploads of VARIABLE_STORE
- Block egress to audit.checkmarx[.]cx and 94.154.172.43 at perimeter and endpoint layers
- Search every user home for /tmp/tmp.987654321.lock and for bw1.js, setup.mjs, and injected blocks in ~/.bashrc and ~/.zshrc
- Audit your GitHub organizations for new repositories matching the Dune-themed naming pattern ({word}-{word}-{3digits}) and delete them after forensic capture
Workarounds
- Temporarily remove @bitwarden/cli from package.json and CI images; use the desktop, browser, or mobile Bitwarden clients, which are unaffected
- If the CLI is load-bearing for CI, run it inside a single-use ephemeral container with no outbound internet egress except to vault.bitwarden.com and with no access to CI secrets until the compromise is contained
Longer-term hardening
- Adopt npm automation with short-lived OIDC-issued tokens (Trusted Publishing) to remove long-lived npm tokens from disk
- Pin every GitHub Action in CI/CD to an immutable commit SHA rather than a tag; enable Required Workflows and allow-lists at the org level
- Require code-signing / Sigstore attestation verification on every npm install in production
- Deploy EDR rules that flag Bun execution by non-developer accounts and any shell profile write outside of provisioning
- Introduce secret scanning at runtime for processes reading .npmrc, az/gcloud/aws config, and ~/.ssh outside of expected tooling
Weaknesses (CWE) in Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
CWE-506, CWE-829, CWE-1357, CWE-494, CWE-798
Timeline of Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
- Checkmarx GitHub Actions workflows and OpenVSX publisher plugins initially compromised; attackers begin staging trojanized KICS ELF (SHA256 2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50) and mcpAddon.js (SHA256 24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9).
- Socket publishes CanisterWorm analysis — npm publisher compromise backdoor across 29+ packages; shares worm-propagation tradecraft later observed in bw1.js.
- Widespread Trivy GitHub Actions tag compromise exposes CI/CD secrets — reinforces pattern of tag-pinned action abuse later used against Bitwarden.
- Socket and Docker publicly disclose malicious Checkmarx KICS Docker images (v2.1.20, v2.1.20-debian, v2.1.21, v2.1.21-debian, alpine, debian, latest) and malicious cx-dev-assist (1.17.0, 1.19.0) and ast-results (2.63.0, 2.66.0) extensions; TeamPCP/@pcpcats takes credit with taunting post.
- Threadlinqs Intelligence publishes TL-2026-0417 with full IOC set, MITRE mapping, detection coverage request, and simulation request to Pentester.
- Socket Security publishes technical analysis of @bitwarden/cli 2026.4.0 compromise; links infrastructure and tooling to ongoing Checkmarx campaign with divergent Shai-Hulud / Butlerian Jihad branding.
- bw1.js observed executing on developer workstations and CI runners that resolved 2026.4.0; Runner.Worker memory scrape and exfil to audit.checkmarx[.]cx/v1/telemetry (94.154.172.43) and Dune-themed GitHub staging repositories live.
- Malicious @bitwarden/cli 2026.4.0 published to npm via compromised GitHub Action in Bitwarden's CI/CD release pipeline; bw1.js embedded in package tarball.
- As of 2026-05-29, the specific @bitwarden/cli 2026.4.0 package is contained (live ~1.5h, ~334 downloads, removed from npm, clean 2026.4.1 shipped, no vault data accessed), but the TeamPCP/Mini Shai-Hulud campaign behind it is escalating — May 11 TanStack/OpenAI, May 12 public source release + BreachForums contest, May 19 639-package atool wave — so its tooling, C2, and worm remain a live concern.
Sources cited for Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
- Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
- Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions
- TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem
- Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
- CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
- npm package @bitwarden/cli (registry listing)
- Bitwarden Password Manager (vendor)
- Checkmarx KICS on Docker Hub
Threats related to Bitwarden CLI 2026.4.0 (@bitwarden/cli) Compromised via
- Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli v2026.4.0) — Shai-Hulud: The Third Coming / TeamPCP
- Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure
- StepSecurity Dev Machine Guard adds fleet-wide developer credential inventory to close blind spot exploited by supply-chain attacks
- Checkmarx Jenkins AST Plugin Supply Chain Compromise — TeamPCP Backdoored Plugin on Jenkins Marketplace
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
Detection coverage for TL-2026-0417
As of 2026-04-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0417 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.