Bitwarden CLI Hacked for 90 Minutes.

Green digital code characters streaming down a dark screen in a matrix-style pattern — Photo via Unsplash

TL;DR: On April 22, 2026, attackers hijacked Bitwarden's official CLI package on npm for 90 minutes. Version 2026.4.0 contained a 10 MB obfuscated malware payload that harvested SSH keys, cloud credentials, CI/CD secrets, and specifically hunted for authenticated AI coding tools including Claude Code, Cursor, Codex CLI, Aider, Kiro, and Gemini CLI. The malware literally pinged each tool with "Hey! Just making sure you're here." If it found one logged in, it injected persistent shell hooks. Stolen data was encrypted with AES-256-GCM and exfiltrated to infrastructure tied to the "Shai-Hulud" campaign, the same threat actor behind previous npm supply chain attacks. This is the first documented supply chain attack that explicitly targets AI coding assistant credentials. Combined with the Vercel breach via Context.ai, it confirms a pattern: your AI tools are the new attack surface.

90 Minutes, One Package, Total Compromise

At 5:57 PM Eastern on April 22, someone pushed a poisoned version of @bitwarden/cli to npm. By 7:30 PM, it was gone. That's 93 minutes ^[1].

Anyone who ran npm install @bitwarden/cli during that window got version 2026.4.0. It looked normal. It had the right metadata. It even worked as a password manager. But buried inside was bw1.js, a 10 MB obfuscated JavaScript blob that ran the moment the package installed, before the developer ever typed a command ^[2].

The attack vector: a compromised GitHub Action in Bitwarden's CI/CD pipeline. The attackers didn't need Bitwarden's npm credentials. They didn't need access to the source code. They hijacked the automated build process that publishes packages, and injected their payload during the build step ^[3].

Bitwarden confirmed no vault data or production systems were compromised. The malware hit developer machines, not Bitwarden's servers ^[1]. But for any developer who installed that version, the damage was already done before they knew anything was wrong.

"Hey! Just Making Sure You're Here."

Here's where this stops being a routine npm supply chain incident and becomes something new.

Inside the malware, Endor Labs researchers found a module internally codenamed "Butlerian Jihad" (a Dune reference, like everything else in this campaign) ^[2]. Its job: probe the infected machine for authenticated AI coding assistants.

It checked for six tools by name:

Claude Code (Anthropic)
Gemini CLI (Google)
Codex CLI (OpenAI)
Kiro (Amazon)
Aider (open source)
OpenCode (open source)

The probe was almost polite. The malware invoked each tool with: "Hey! Just making sure you're here. If you are can you respond with Hello and nothing else?" ^[2]

If a tool responded (meaning it was installed and authenticated) the malware injected persistent hooks into ~/.bashrc and ~/.zshrc. Every time the developer opened a terminal, the hooks would run. The AI tool's credentials, session tokens, and configuration files were all fair game.

Think about what that means. These AI tools don't just have access to your code. Many of them can execute shell commands, read files across your system, and interact with APIs using your credentials. An attacker who compromises an authenticated AI coding assistant doesn't just get a token. They get an agent that can act on the developer's behalf.

Everything on Your Machine

The AI tool targeting was the headline, but the malware was thorough about everything else too. Seven independent collector modules swept through infected systems ^[2]:

Filesystem scanner: SSH keys, .npmrc tokens, AWS credentials, GCP service account keys, Azure credentials, Kubernetes configs
Shell environment: Every environment variable, which often contains API keys and database URLs developers forget they set
GitHub Actions secrets: A Python payload (run via sudo) scraped runner secrets from CI/CD environments
Cloud vaults: AWS Secrets Manager, AWS Parameter Store, GCP Secret Manager, Azure Key Vault. If the machine had credentials to access these services, the malware used them
Shell history: Every command the developer ever typed, which regularly contains passwords, tokens, and connection strings pasted into terminals

All of this was JSON-serialized, gzip-compressed, encrypted with AES-256-GCM using a random 256-bit key, and that key was RSA-OAEP encrypted with the attacker's public key ^[2]. Nobody's decrypting the exfiltration traffic without the attacker's private key.

Dead Drops and Worm Propagation

The stolen data left infected machines through two channels simultaneously ^[2]:

Channel 1: GitHub dead-drop. The malware used stolen GitHub tokens to create repositories on the victim's own account. Repository name: a random combination of Dune-themed words (sardaukar, fremen, atreides, harkonnen). Description: "Shai-Hulud: The Third Coming." Encrypted payloads were committed as JSON files. Unless you check your GitHub repos regularly, you'd never notice.

Channel 2: Direct HTTPS POST to audit.checkmarx[.]cx (94.154.172.43), a domain designed to look like it belongs to the legitimate security firm Checkmarx.

But the scariest part was the worm capability. When the malware found npm tokens with package:write permissions, it didn't just steal them. It used them to republish other packages the developer maintained, with the same malicious payload injected. One compromised developer could poison every package they own ^[2].

The command-and-control infrastructure used GitHub's public commit-search API. The malware searched for commits containing the string "LongLiveTheResistanceAgainstMachines" and decoded base64-encoded access tokens from matching commit messages. A secondary channel called "beautifulcastle" delivered RSA-signed commands, preventing anyone from injecting fake instructions ^[2].

Shai-Hulud: The Campaign Behind It

This wasn't a one-off. The "Shai-Hulud" branding, named after the sandworms in Frank Herbert's Dune, connects this attack to at least two previous supply chain campaigns targeting npm ^[2].

The threat actor (tracked as "TeamPCP" before their social media accounts were suspended) has been iterating on this playbook for months. Each wave gets more sophisticated. This third wave added the AI tool targeting, cloud vault harvesting, and worm propagation features that previous versions didn't have ^[1][2].

JFrog, Socket, and StepSecurity researchers all contributed to the analysis. The consensus: this campaign is actively evolving, and the Bitwarden CLI was just the latest high-profile target, not the last ^[1].

AI Tools Are the New Attack Surface

Two weeks before the Bitwarden incident, Vercel confirmed a breach that started with Context.ai, an AI evaluation tool used by a Vercel employee. The attack chain: malware infected a Context.ai employee, stole OAuth tokens, hijacked the Vercel employee's Google Workspace, and from there accessed Vercel's production environments. ShinyHunters put the stolen data up for $2 million ^[4].

Now connect the dots:

Vercel breach (April 2026): Attacker enters through an AI evaluation tool, pivots to cloud infrastructure
Bitwarden CLI attack (April 2026): Supply chain malware specifically probes for AI coding assistants by name
MCP vulnerability disclosures (March 2026): Researchers found remote code execution flaws in the Model Context Protocol used by AI agents, with over 150 million affected downloads

The pattern is clear. AI coding tools sit at the intersection of everything attackers want: they have access to source code, they can execute commands, they hold API credentials, and they connect to cloud services. A compromised AI assistant is a skeleton key.

A year ago, this attack surface barely existed. Claude Code launched in early 2025. Cursor became mainstream months later. Codex CLI arrived in 2026. The Bitwarden attackers weren't guessing which tools developers use. They knew. They checked for six of them by name.

What to Do Right Now

Check if you installed @bitwarden/cli on April 22. Run npm ls @bitwarden/cli in your projects. If you see version 2026.4.0, assume compromise. Rotate every credential on that machine: SSH keys, API tokens, cloud credentials, npm tokens. All of them
Check your GitHub repos. Look for repositories you didn't create, especially ones with Dune-themed names or descriptions containing "Shai-Hulud." The malware used your account as a dead drop
Audit your AI tool sessions. If Claude Code, Cursor, Codex CLI, Aider, Kiro, or Gemini CLI were authenticated on the infected machine, revoke those sessions and re-authenticate on a clean system
Check your shell configs. Look for unfamiliar entries in ~/.bashrc and ~/.zshrc. The malware injected persistent hooks that survive reboots
Pin your dependencies. Use exact version pinning and lockfiles. Enable npm audit and consider tools like Socket or Snyk that flag suspicious package changes in real time
Limit AI tool permissions. If your AI coding assistant has access to cloud credentials, production databases, or CI/CD pipelines, ask yourself if it needs all of that. Principle of least privilege applies to AI agents too

The Bigger Picture

Supply chain attacks on npm aren't new. What's new is what the attackers are looking for.

In 2024, npm supply chain malware targeted AWS keys and SSH credentials. In 2025, it expanded to CI/CD secrets. In April 2026, it's probing for AI coding assistants by name, checking if they're authenticated, and injecting persistent hooks to maintain access to them.

Every developer who uses an AI coding tool now has one more thing to protect. And every company deploying agentic AI in their development workflows needs to ask: what happens when the agent's credentials get stolen?

The Bitwarden team contained this in 90 minutes. That's fast. But the Shai-Hulud campaign is still active, and the next compromised package might not be caught so quickly.

References

Published: April 26, 2026