@bitwarden/cli:2026.4.0 infected with malware?

[pathmissing (Marcus)]

There have been multiple reports that the npm package @bitwarden/cli has been compromised in version 2026.4.0:

• OpenSourceMalware.com - Community Threat Intelligence
• https://x.com/JFrogSecurity/status/2047268576071991766

Has there been any official confirmation from the Bitwarden team?

[grb]

I am a volunteer moderator here (i.e., a Bitwarden user, not an employee), so this is not an official confirmation, but I wanted to share with you that mods have received information that Bitwarden has taken action on this and will be making some kind of public announcement. Stay tuned…

[grb]

This Github comment has the first official response from a Bitwarden rep:

JFrog Security: Possible compromised Supply-Chain of Bitwarden CLI

“We verified that a malicious version of CLI was published to NPM as 2026.4.0. We have since deprecated that version and contacted NPM for its removal.”

[grb]

And now there is a slightly more detailed statement, in a pinned post on the forum:

Bitwarden Statement on Checkmarx Supply Chain Incident

The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/cli@2026.4.0 between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious …

[eck (Adam Eckerle)]

Closing this topic and encourage people to continue the discussion in the pinned topic @grb linked above.