Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by nicce on Thursday April 23, 2026 @11:43AM (#47877124)

I thought that CLI would be efficent when I looked for using it and then I figured it is JavaScript

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by rvz on Thursday April 23, 2026 @11:58AM (#47877344)

Exactly. That is the problem.

There is a time and place for where it makes sense and a password manager CLI written in TypeScript importing hundreds of third-party packages is a direct red flag. It is a frequent occurrence.

We have seen it happen with Axios which is one of the biggest supply chain attacks on the Javascript / Typescript ecosystem and it makes no sense to build sensitive tools with that.

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by lxgr on Thursday April 23, 2026 @03:10PM (#47880203)

> importing hundreds of third-party packages

But how else are you going to check if a number is even or odd? Remember, the ONLY design goal is not repeating yourself (or in fact anything anyone has ever thought of implementing).

[ Parent | on HN ]

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by dannyw on Thursday April 23, 2026 @05:11PM (#47882085)

That’s a serious red flag. I’m concerned and I don’t think it shows a security first culture.

[ Parent | on HN ]