Bitwarden CLI Hit by Supply Chain Attack, Malicious Package Distributed for 1.5 Hours

Gate News message, April 24 — Bitwarden CLI version 2026.4.0 was compromised in a supply chain attack between 17:57 and 19:30 ET on April 24, according to SlowMist CISO 23pds. Attackers exploited GitHub Actions in Bitwarden’s CI/CD pipeline to inject a malicious package that was briefly distributed via npm.

The attack targeted the repository’s continuous integration workflow, allowing unauthorized code to reach the package registry. However, Bitwarden confirmed that Vault data was not compromised, production systems were unaffected, and only users who installed version 2026.4.0 from npm during the 1.5-hour window were impacted.

Bitwarden advised affected users to immediately uninstall version 2026.4.0, clear npm cache, rotate API tokens and SSH keys, audit GitHub and CI activity for anomalies, and upgrade to the patched version 2026.4.1.