Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by trinsic2 on Thursday April 23, 2026 @11:29AM
(#47876935)
Wow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.
[ Parent
| on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by 1024kb on Thursday April 23, 2026 @11:36AM
(#47877025)
I don't know, I use a vanilla weechat setup
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by harshreality on Thursday April 23, 2026 @12:34PM
(#47877817)
It's crazy because it's not default bw behavior, or even any bw behavior... I don't use the cli, but I don't see any built-in capacity to copy bw output to the clipboard. (In the UNIX way, you'd normally pipe it to a clipboard utility if you wanted it copied, and then the security consequences are on you.)
They probably caused it themselves, somehow, and then blamed bitwarden. Note in the original comment they aren't even entirely sure what the command was, and they weren't familiar with it or they wouldn't have been surprised by its output... so how can they be sure what else they did between that command and the weechat thing?
If the terminal or tmux fed terminal history into weechat, that's also not bw's problem.
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by pprotas on Thursday April 23, 2026 @03:06PM
(#47880143)
`bw list` shows plaintext credentials in the CLI https://bitwarden.com/help/cli/#list
I know this because I had the same surprised reaction