Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli v2026.4.0) — Shai-Hulud: The Third Coming / TeamPCP

Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli (TL-2026-0429), also tracked as Shai-Hulud: The Third Coming, is a critical-severity supply-chain compromise scored CVSS 9.6, first published 2026-04-27. It is attributed to TeamPCP with high confidence, affects Bitwarden @bitwarden/cli (npm package), maps to 25 MITRE ATT&CK techniques (T1003.007, T1027, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0429

Threat ID
TL-2026-0429
Also known as
Shai-Hulud: The Third Coming, Bitwarden CLI npm hijack, TeamPCP Bitwarden incident
Severity
CRITICAL
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-04-27
Last reviewed
2026-04-27
Attribution
TeamPCP
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
technology, software-development, financial, government, healthcare, consulting, any-sector-with-developers
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
22

Malware and tooling in Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

Malware and tooling: Shai-Hulud / bw1.js, bw1.js (Shai-Hulud Third Coming variant), GitHub-as-C2 (public repos with Dune-themed names {word}-{word}-{3digits}), __decodeScrambled (custom XOR/character-shift obfuscator, seed 0x3039)

TeamPCP operators hijacked Bitwarden's CI/CD pipeline through a compromised checkmarx/ast-github-action and published a malicious @bitwarden/cli@2026.4.0 to npm for ~93 minutes on 2026-04-22 (5:57 PM–7:30 PM ET), netting 334 confirmed installs before takedown. The embedded bw1.js payload harvested GitHub/npm tokens, SSH keys, .env files, AWS/Azure/GCP credentials, and AI-tool configs (Claude/Cursor/Codex/Aider/Kiro), memory-scraped the GitHub Actions Runner.Worker, AES-256-GCM-encrypted the loot, and exfiltrated to audit.checkmarx[.]cx and Dune-themed public GitHub repos while self-propagating as an npm worm. This is the third confirmed Shai-Hulud campaign wave, following the Trivy and LiteLLM compromises run by the same actor cluster.

How Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli works

On 2026-04-22 at 17:57 ET, attackers tracked as TeamPCP — the operators behind the broader Shai-Hulud campaign — published a malicious version 2026.4.0 of the @bitwarden/cli npm package, the official command-line interface for the Bitwarden password manager (~250,000 monthly downloads). The package was removed at approximately 19:30 ET, but Socket and JFrog telemetry confirms 334 installations during the ~93-minute window.

ROOT CAUSE — CI/CD COMPROMISE VIA THIRD-PARTY GITHUB ACTION: Investigation by Bitwarden, Endor Labs, and JFrog determined that the attacker did not compromise Bitwarden infrastructure or developer credentials directly. Instead, they compromised the checkmarx/ast-github-action GitHub Action — a third-party SAST integration consumed by Bitwarden's release pipeline. By poisoning a transitive workflow dependency, the attacker gained execution inside Bitwarden's GitHub-hosted runners with access to scoped NPM_TOKEN secrets, which they used to publish the trojanized package version.

PAYLOAD — bw1.js: The malicious version embeds an obfuscated JavaScript payload (bw1.js) executed via the package's postinstall hook. Static analysis by Socket and Endor Labs identified the payload's __decodeScrambled() routine using a numeric seed of 0x3039 (12345 decimal) for XOR/character-shift deobfuscation. Once decoded, bw1.js performs a multi-stage credential harvesting operation across Linux, macOS, and Windows hosts:

1. Filesystem credential sweep — recursively scans the user home directory and project trees for: ~/.aws/credentials, ~/.aws/config, ~/.azure/, ~/.config/gcloud/, ~/.npmrc, ~/.gitconfig, ~/.git-credentials, ~/.docker/config.json, ~/.kube/config, ~/.ssh/id_rsa/id_ed25519/id_ecdsa, .env / .env.local / .env.production files, GitHub Actions workflow files exposing secrets in plaintext, and CI runner mount paths under /run/secrets and /var/run/secrets.

2. AI-tool configuration theft — explicitly enumerates and exfiltrates configuration and session files for Anthropic Claude (Claude Code config, MCP server tokens), Cursor IDE, OpenAI Codex CLI, Aider, and AWS Kiro. This is novel: Shai-Hulud is the first observed npm-borne worm with explicit AI-developer-tool targeting. The attacker is interested both in API keys (for monetization or further attack infrastructure) and in stored project context that may reveal additional secrets.

3. Memory scraping of GitHub Actions Runner.Worker — when bw1.js detects execution under a GitHub Actions runner (GITHUB_ACTIONS=true), it locates the Runner.Worker process and reads its memory regions to extract decrypted secret values that GitHub injects as masked env vars. This bypasses the normal log-redaction protection because the values are already in cleartext in process memory.

4. Persistence via shell profile modification — appends a hidden launcher to ~/.bashrc and ~/.zshrc on Unix-like systems so that any subsequent interactive shell re-runs the harvester. A process lock file at /tmp/tmp.987654321.lock prevents concurrent re-entry on the same host.

5. Exfiltration — collected loot is concatenated, AES-256-GCM encrypted with a key derived from a hard-coded seed plus a per-host random nonce, and transmitted via HTTPS POST to https://audit.checkmarx[.]cx/v1/telemetry (resolving to 94.154.172.43, an attacker-controlled host impersonating Checkmarx). A fallback channel mirrors the encrypted blob into a freshly-created public GitHub repository on the victim's own account, named with a Dune-themed convention {word}-{word}-{3digits} (e.g. fremen-sietch-742, muaddib-shadout-018, harkonnen-arrakis-301). The encrypted commit body contains the marker string 'LongLiveTheResistanceAgainstMachines', which is now a high-confidence atomic indicator.

6. npm worm self-propagation — using the harvested npm tokens, bw1.js enumerates packages owned by the victim's npm account, repackages each with the bw1.js postinstall payload as package-updated.tgz, increments the patch version, and publishes the trojanized release. This is the worm component that drove Shai-Hulud's prior Trivy and LiteLLM waves and turns every successful credential capture into a downstream supply chain incident.

DEFENSE EVASION: The payload performs a Russian locale check (process.env.LANG / system locale APIs) and exits silently if a Russian-speaking environment is detected, suggesting the operators wish to avoid local law enforcement attention or are operating from a Russian-speaking jurisdiction. The obfuscator's seed 0x3039 is shared with the Trivy and LiteLLM bw1.js variants, providing strong code-similarity evidence linking the three campaigns to a single tooling baseline. Network exfiltration mimics legitimate Checkmarx telemetry shape on the audit.checkmarx[.]cx fake-vendor domain to evade DLP heuristics watching for unknown destinations.

ATTRIBUTION: TeamPCP — also tracked as the Shai-Hulud actor cluster by Endor Labs, Ox Security, and JFrog — has been linked to two prior npm supply chain campaigns in 2026: the Trivy GitHub Action compromise (~2026-03) and the LiteLLM npm package compromise (~2026-04, weeks before this incident). Attribution is HIGH confidence based on shared payload tooling (identical __decodeScrambled obfuscator with seed 0x3039), shared C2 infrastructure pattern (vendor-impersonation domains hosted on the same CIDR neighborhood), shared exfiltration marker string, and the Dune-themed GitHub repository naming convention seen in all three campaigns.

BLAST RADIUS: With 334 confirmed installs of @bitwarden/cli@2026.4.0 — many on developer workstations and CI runners with broad cloud privileges — the credential-theft impact is severe. Defenders must treat any cloud, GitHub, npm, or AI-platform credential touched by an affected host as compromised, rotate immediately, and audit downstream npm packages owned by victim npm accounts for worm-injected republishes.

REMEDIATION: Bitwarden has published a clean v2026.4.1 release. The malicious 2026.4.0 has been unpublished by npm. Affected organizations should: (a) inventory all hosts that ran `npm install @bitwarden/cli@2026.4.0` between 17:57 ET and 19:30 ET on 2026-04-22; (b) rotate every credential that existed on those hosts (cloud keys, GitHub PATs, npm tokens, SSH keys, AI-tool API keys); (c) audit GitHub for Dune-pattern public repos created on victim accounts; (d) block audit.checkmarx[.]cx and 94.154.172.43 at egress; (e) review every npm package owned by potentially-compromised npm accounts for unauthorized republishes.

MITRE ATT&CK techniques used in TL-2026-0429

Credential Access

T1003.007 OS Credential Dumping: Proc Filesystem; T1056.004 Input Capture: Credential API Hooking; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555 Credentials from Password Stores

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1480.001 Execution Guardrails: Environmental Keying

Exfiltration

T1041 Exfiltration Over C2 Channel; T1537 Transfer Data to Cloud Account; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository

Discovery

T1057 Process Discovery; T1083 File and Directory Discovery

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.003 User Execution: Malicious Image

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography

stealth

T1078.004 Valid Accounts: Cloud Accounts

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.003 Compromise Hardware Supply Chain; T1199 Trusted Relationship

Persistence

T1546.004 Event Triggered Execution: Unix Shell Configuration Modification; T1554 Compromise Host Software Binary

Affected products and versions in Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

  • Bitwarden — @bitwarden/cli (npm package)
    Vulnerable versions: 2026.4.0
    Fixed in: 2026.4.1
  • Checkmarx — checkmarx/ast-github-action (GitHub Action)
    Vulnerable versions: compromised tag references prior to 2026-04-22
    Fixed in: pin to vendor-published clean commit SHA
  • GitHub — GitHub Actions Runner (impacted as exfiltration vector via Runner.Worker memory scrape)
    Vulnerable versions: all versions when running compromised workflows
    Fixed in: N/A — defense is workflow hygiene

Remediation for Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

Patches

  • Bitwarden — install @bitwarden/cli@2026.4.1 or later; verify SHA-256 of installed tarball against vendor-published hash.
  • Checkmarx — pin or replace checkmarx/ast-github-action; consult vendor advisory for the upstream GitHub Action remediation.

Immediate actions

  • Inventory every host that executed `npm install @bitwarden/cli@2026.4.0` between 2026-04-22 17:57 ET and 19:30 ET — check npm cache logs, CI build logs, and Software Bill of Materials manifests.
  • Block audit.checkmarx[.]cx and 94.154.172.43 at the network egress layer (firewall, proxy, DNS RPZ).
  • Rotate every credential that existed on a confirmed-affected host: AWS/Azure/GCP keys, GitHub PATs and OAuth tokens, npm tokens, SSH keys, GitLab tokens, Docker registry tokens, Anthropic/OpenAI/Cursor/Codex/Aider/Kiro API keys.
  • Audit GitHub for newly created public repositories on potentially-victim accounts matching the Dune naming pattern {word}-{word}-{3digits}; delete and treat their content as encrypted exfiltrated secrets.
  • Hunt for the marker string 'LongLiveTheResistanceAgainstMachines' across GitHub commit bodies on victim accounts.
  • Review every npm package owned by a potentially-compromised npm account for unauthorized version publishes (worm self-propagation) since 2026-04-22.

Workarounds

  • If immediate patching is not possible, uninstall @bitwarden/cli entirely and use the desktop client until patched version is verified.
  • Disable npm postinstall scripts globally via `npm config set ignore-scripts true` while triaging.

Longer-term hardening

  • Pin third-party GitHub Actions to immutable commit SHAs rather than mutable tag references (e.g. checkmarx/ast-github-action@<sha>), per OpenSSF Scorecard guidance.
  • Adopt npm provenance attestations (--provenance) for all first-party packages so tampering is detectable.
  • Run all CI builds in ephemeral, network-restricted runners with explicit egress allowlists (block all, allow registry.npmjs.org / api.github.com only).
  • Deploy npm install-time scanners (Socket, Snyk Advisor, Endor Labs, JFrog Xray) that flag postinstall scripts and unusual network calls before package execution.
  • Move secret material out of CI env vars and into short-lived, identity-federated tokens (OIDC) so memory scraping yields ~minute-lifetime credentials only.
  • Mandate that engineers scope npm publish tokens to single-package, granular-access tokens rather than account-wide automation tokens.

Weaknesses (CWE) in Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

CWE-506, CWE-829, CWE-915, CWE-494, CWE-522, CWE-798

Timeline of Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

  • First documented Shai-Hulud / TeamPCP wave: Trivy GitHub Action compromise, establishing the bw1.js obfuscator with seed 0x3039 and Dune-themed exfil-repo naming convention later seen in this incident.
  • TeamPCP / Shai-Hulud second wave: LiteLLM npm package compromised, propagating bw1.js via npm postinstall and reusing the audit-style fake-vendor C2 pattern.
  • checkmarx/ast-github-action pipeline poisoned by TeamPCP, providing the trusted-relationship foothold into any consumer's CI workflow that pinned the Action by mutable tag.
  • Bitwarden security and npm registry detect anomalous publish at approximately 19:30 ET (~93 minutes after publish) and unpublish 2026.4.0 from the registry; a clean 2026.4.1 is rapidly cut and signed.
  • 334 confirmed npm installs of the malicious version across developer workstations and CI runners worldwide; bw1.js postinstall begins credential harvesting, AI-tool config theft, Runner.Worker memory scraping, and worm self-propagation.
  • @bitwarden/cli@2026.4.0 published to npm at 17:57 ET via attacker-controlled execution inside Bitwarden's GitHub Actions runner, signed with the legitimate scoped NPM_TOKEN.
  • Coordinated disclosure: Bitwarden official statement, Socket, Endor Labs, Ox Security, JFrog, SOCRadar, BleepingComputer, SecurityWeek, and The Hacker News publish technical analyses, IOCs, and TeamPCP / Shai-Hulud attribution.
  • Researchers expand IOC list to include the LongLiveTheResistanceAgainstMachines marker, the Dune-themed public-repo naming pattern, and the seed-0x3039 obfuscator fingerprint as code-similarity link to Trivy and LiteLLM waves.
  • Downstream npm worm propagation observed: at least a dozen smaller packages owned by victim Bitwarden CLI users republished with bw1.js postinstall, prompting registry-wide takedowns and renewed npm-account 2FA enforcement guidance.
  • Threadlinqs Intelligence publishes TL-2026-0429 with full MITRE mapping, detection coverage, and BeaconBeagle correlation on the audit.checkmarx[.]cx C2 infrastructure.
  • As of 2026-05-29, the specific @bitwarden/cli@2026.4.0 package was unpublished within ~93 min and replaced by clean v2026.4.1, but the TeamPCP/Shai-Hulud actor and bw1.js (seed-0x3039) tooling remain a live, escalating threat. Same cluster ran new waves (TanStack May 11, @antv May 19: 639 malicious versions) and publicly released the Mini Shai-Hulud toolchain May 12; no takedown or arrest.

Sources cited for Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

Threats related to Bitwarden CLI npm Supply Chain Compromise (@bitwarden/cli

Detection coverage for TL-2026-0429

As of 2026-04-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0429 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats