The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.

Three supply chain attacks hit npm, PyPI, and Docker Hub between April 21–23, 2026. All three targeted secrets: API keys, cloud credentials, SSH keys, and tokens from developer environments and CI/CD ...

A malicious version of Bitwarden's CLI password manager was briefly distributed via npm after attackers exploited a compromised GitHub Action, in a campaign linked to the Checkmarx supply chain attack ...

ThreatsDay Bulletin: active exploits, supply chain attacks, AI abuse, and stealth data risks observed this week.

Attackers published a malicious command-line version of the popular open-source password manager to the npm registry and may ...

This is a minimally-edited transcript that originates from a program that uses AI. Anita Rao This is Embodied, from PRX and WUNC. I’m Anita Rao. Comedian Chris Duff ...

The Bitwarden security team confirms that a malicious version of the command-line client was briefly distributed.

Microsoft has made its 365 Copilot an agentic AI by default, enabling it to perform in-app actions autonomously across Word, Excel, and other tools. Alongside this upgrade, a new 'flex routing' ...