تقنية·24.04.2026ملخص الذكاء الاصطناعي Malicious Bitwarden CLI Package Exfiltrated Infrastructure Credentials via Compromised npm Release
On April 22, 2026, a malicious version of Bitwarden's command-line interface was published to npm under the official package name @bitwarden/[email protected], remaining available for 93 minutes. The compromised package targeted infrastructure credentials including GitHub tokens, npm tokens, SSH keys, AWS/GCP/Azure credentials, and GitHub Actions secrets. Security firm JFrog analyzed the payload and found it had no interest in Bitwarden vaults—only in credentials governing build, deployment, and infrastructure automation. Bitwarden confirmed the incident is connected to the broader Checkmarx supply chain campaign and found no evidence of end-user vault access or production system compromise.