Bitwarden CLI Supply Chain Attack Puts Crypto Wallet Keys at Risk
Attackers hijacked password supervisor Bitwarden’s CLI model 2026.4.0 by a compromised GitHub Action, publishing a malicious npm bundle that actively steals crypto pockets information and developer credentials.
Security agency Socket found the breach on April 23 and linked it to the continuing TeamPCP provide chain marketing campaign. The rogue npm model has since been pulled.
Malware Target Risks Crypto Wallets and CI/CD Secrets
The malicious payload, embedded in a file known as bw1.js, ran throughout bundle set up and harvested GitHub and npm tokens, SSH keys, atmosphere variables, shell historical past, and cloud credentials.
TeamPCP’s broader marketing campaign is individually confirmed to focus on crypto pockets information, together with MetaMask, Phantom, and Solana pockets information.
According to JFrog, the stolen information was exfiltrated to attacker-controlled domains and dedicated again to GitHub repositories as a persistence mechanism.
Many crypto groups use the Bitwarden CLI in automated CI/CD pipelines for secrets and techniques injection and deployments. Any workflows that ran the compromised model might have uncovered high-value pockets keys and exchange API credentials.
Security researcher Adnan Khan famous that is the primary identified compromise of a bundle utilizing npm’s trusted publishing mechanism, which was designed to get rid of long-lived tokens.
What Affected Users Should Do
Socket recommends that anybody who put in @bitwarden/cli model 2026.4.0 rotate each uncovered secret instantly.
Users ought to downgrade to model 2026.3.0 or swap to official signed binaries from Bitwarden’s web site.
TeamPCP has chained related assaults towards Trivy, Checkmarx, and LiteLLM since March 2026, concentrating on developer instruments that sit deep in construct pipelines.
Bitwarden’s core vault stays unaffected. Only the CLI construct course of was compromised.
The publish Bitwarden CLI Supply Chain Attack Puts Crypto Wallet Keys at Risk appeared first on BeInCrypto.