News for hackers. Stuff that matters.

A comment on Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign.

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by sigmonsays on Thursday April 23, 2026 @11:12AM (#47876704)
If I run the compromised CLI, do they get all my passwords?
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by bhouston on Thursday April 23, 2026 @11:23AM (#47876853)
Exactly, that could widen the blast radius of this particular compromise significantly.
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by kbolino on Thursday April 23, 2026 @11:33AM (#47876981)
No, at least according to Bitwarden themselves: https://community.bitwarden.com/t/bitwarden-statement-on-che...
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by NeckBeardPrince on Thursday April 23, 2026 @11:23AM (#47876851)
Read the article
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by valicord on Thursday April 23, 2026 @11:44AM (#47877150)
Where does it answer this question in the article?
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by rtaylorgarlock on Thursday April 23, 2026 @11:25AM (#47876875)
kinda crazy to see this comment required in this particular context, yet here we are
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by hgoel on Thursday April 23, 2026 @11:27AM (#47876894)
It's an understandable question, the article reads like an AI generated mess.
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by ErneX on Thursday April 23, 2026 @11:24AM (#47876868)
The article explains what is extracted.
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by jeroenhd on Thursday April 23, 2026 @12:03PM (#47877403)
The article waffles on forever and gives some generic advice.

Meanwhile, Bitwarden themselves state that end users were almost never affected: https://community.bitwarden.com/t/bitwarden-statement-on-che...

You had to install the CLI through NPM at a very short time frame for it to be affected. If you did get infected, you have to assume all secrets on your computer were accessed and that any executable file you had write access to may be backdoored.

[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by valicord on Thursday April 23, 2026 @11:44AM (#47877152)
No it doesn't?
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by ErneX on Thursday April 23, 2026 @12:06PM (#47877439)
Yes it does, under technical analysis. I don’t want to paste it here when it’s laid out in the article…
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by hgoel on Thursday April 23, 2026 @12:13PM (#47877518)
It seems to be describing what the Checkmarx vulnerability allows to be done on a GitHub Actions runner?
[ Parent | on HN ]