The write up is disingenuous, or confusing at best. It highight early on “no evidence that end user vault data was accessed or at risk”.
Then further down recommends to “Rotate any secrets that may have been exposed…” and “Review GitHub activity, CI workflows, and related credentials for unauthorized access or changes”.
How could they even find evidence of end user data and vault being accessed? The CLI compromises affects end user systems, which they have no visibility into.
The worst is saying there’s no evidence of risk, while making recommendations based on the assumption all data and secrets on affected systems may be compromised. That’s a good assumption because there’s definitely a risk.
It’s because the malicious package is not targeting but warden creds. Here is a write up of what it does. https://research.jfrog.com/post/bitwarden-cli-hijack/#infection-vector-assessment
Operationally, the infection flow is simple:
A victim installs or runs @bitwarden/cli version 2026.4.0 npm executes preinstall, which runs bw_setup.js The loader downloads Bun from GitHub if needed Bun runs the malicious payload The payload steals local, CI, GitHub, and cloud secrets The result set is encrypted and sent to audit[.]checkmarx[.]cx If that path fails, the malware pivots to GitHub-based fallback channels
Framing it as a checkmarx supply chain incident is also disingenious when it was a supply chain attack via bitwarden targeted at bitwarden users.
