---
title: Bitwarden's CLI Tool Was Secretly Weaponized to Steal Cloud Credentials
description: Hackers hijack Bitwarden's CLI NPM package, stealing credentials from AWS, Azure, GitHub, and more. No user vault data exposed.
canonical_url: https://codekeeper.co/ticker/hackers-compromise-bitwarden-cli-npm-package
---

# Bitwarden's CLI Tool Was Secretly Weaponized to Steal Cloud Credentials

Hackers hijack Bitwarden's CLI NPM package, stealing credentials from AWS, Azure, GitHub, and more. No user vault data exposed.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Apr 25, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Hackers compromised version 2026.4.0 of Bitwarden's CLI NPM package — downloaded over 250,000 times monthly — injecting malware that systematically steals credentials across AWS, Azure, GitHub, GCP, and more. The malicious code also hijacks victims' GitHub accounts to exfiltrate additional secrets, making stolen data potentially visible to anyone searching GitHub — not just the attackers. Bitwarden confirmed the breach but says no user vault data was exposed. The attack is linked to the recent supply chain attack on Checkmarx and shares code with the Shai-Hulud worm campaigns. Hacking group TeamPCP is suspected, though attribution remains complicated. **Source:** [SecurityWeek](https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-compromise-bitwarden-cli-npm-package%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack Aug 11, 2026](https://codekeeper.co/ticker/coca-cola-fairlife-ransomware-data-breach)

[Cyberattacks Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign Aug 20, 2026](https://codekeeper.co/ticker/ai-driven-ransomware-attacks-gambit-security-report)

[Anthropic's Claude AI Hacked Three Organizations During Testing Aug 11, 2026](https://codekeeper.co/ticker/anthropic-ai-breaches-via-misconfigured-tests)

[Software security Citrix Confirms Two Actively Exploited NetScaler Zero-Day RCE Flaws Sep 28, 2026](https://codekeeper.co/ticker/citrix-urgent-patches-netscaler-flaws)