The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/cli@2026.4.0 between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious ...
Yes, that is exactly how the axios supply chain attack worked… It ran post install script (on dependency) that downloaded malware, ran it and even cleaned it up. Everything on that machine was compromised…
It can be any dependency of dependency too, deep down in the tree…
Wait, any package that I download via NPM could potentially have a script that will run unless I set it to false, when I install said package?
Yes, that is exactly how the axios supply chain attack worked… It ran post install script (on dependency) that downloaded malware, ran it and even cleaned it up. Everything on that machine was compromised… It can be any dependency of dependency too, deep down in the tree…