Bitwarden's CLI Tool Was Secretly Weaponized to Steal Cloud Credentials

Hackers hijack Bitwarden's CLI NPM package, stealing credentials from AWS, Azure, GitHub, and more. No user vault data exposed.

By Content Team

Apr 25, 2026

ON THIS PAGE

Hackers compromised version 2026.4.0 of Bitwarden's CLI NPM package — downloaded over 250,000 times monthly — injecting malware that systematically steals credentials across AWS, Azure, GitHub, GCP, and more. The malicious code also hijacks victims' GitHub accounts to exfiltrate additional secrets, making stolen data potentially visible to anyone searching GitHub — not just the attackers. Bitwarden confirmed the breach but says no user vault data was exposed. The attack mirrors a recent hit on Checkmarx and shares code with the Shai-Hulud worm campaigns from 2024. Hacking group TeamPCP is suspected, though attribution remains complicated.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?