Date: 2026-04-23
The npm package @bitwarden/cli@2026.4.0 contains a malicious install-time payload. The package adds a preinstall hook that runs a Node bootstrapper, downloads Bun if needed, then executes a large obfuscated Bun bundle named bw1.js.
This is a full supply-chain worm and secret exfiltration agent. It harvests local secrets, CI secrets, GitHub repository secrets, and cloud secret stores, then exfiltrates encrypted results and uses stolen npm tokens to publish infected package updates.