@bitwarden/cli 2026.4.0 hijacked via Checkmarx GitHub Actions breach

What happened

On April 22, 2026, between 17:57 and 19:30 ET, TeamPCP pushed a malicious @bitwarden/cli@2026.4.0 to npm. The vector was not a direct Bitwarden compromise: it leveraged Bitwarden's use of the breached checkmarx/ast-github-action from the parallel multi-2026-04-22-checkmarx-kics-vsx-docker operation. The Checkmarx GitHub Action ran in Bitwarden's CI with publish-token access, and that's what produced the malicious release.

The entry-point script was bw_setup.js. It fetched Bun 1.3.13 from GitHub Releases and ran an obfuscated payload that targeted a deliberate list of credential surfaces: SSH and Git config, npm and GitHub tokens, AWS / GCP / Azure profiles, GitHub Actions runner secrets, and a notable set of AI/MCP configs — .claude.json, .kiro/settings/mcp.json, and similar — reflecting the shifting prize for these operators.

The payload included two telling pieces: a Russian-locale kill switch (skip execution if the host language is ru-RU) and a shell-profile persistence write into ~/.bashrc and ~/.zshrc that re-sources an attacker script on next shell start. Exfiltration ran through audit.checkmarx.cx, the same endpoint as the Checkmarx KICS / Open VSX push.

Live window was about 90 minutes before npm yanked the release. Bitwarden confirmed in their post-incident statement that no end-user vault data was accessed — the malware operated on the CLI host's own developer/CI credentials, not on stored Bitwarden vault content. If you resolved 2026.4.0, run the uninstall + rotation sequence in the recommendations and audit your shell rc files for unexpected sourcing.

Affected packages (1)

Impact

• Developer workstation and CI credential theft including AI tool configs
• GitHub PATs validated and reused to stage exfiltration repos
• Russian-locale kill switch present in the payload
• Shell-profile persistence via ~/.bashrc and ~/.zshrc injection

What to do

1. 1npm uninstall -g @bitwarden/cli; npm cache clean --force; npm config set ignore-scripts true
2. 2Revoke GitHub PATs, rotate npm/AWS/Azure/GCP credentials, inspect Actions logs
3. 3Audit ~/.bashrc and ~/.zshrc for unexpected sourcing of attacker scripts
4. 4Block audit.checkmarx.cx at egress

References

• JFrog: @bitwarden/cli hijack via Checkmarx breach

  research.jfrog.com
  JFrog