Bitwarden CLI suffered a supply chain attack, with a malicious package circulating for about 1.5 hours
By: rootdata|2026/04/24 02:51:51
0
Share
SlowMist CISO 23pds disclosed that the password management tool Bitwarden CLI version 2026.4.0 suffered a Checkmarx supply chain attack between 17:57 and 19:30 Eastern Time. The attacker briefly distributed a malicious package via npm by abusing the GitHub Action in the Bitwarden CI/CD pipeline.
The official confirmation states that Vault data was not leaked, and production systems were not affected; only users who installed this version via npm during that time window were impacted. The official recommendation for affected users is to immediately uninstall 2026.4.0, clean the npm cache, rotate sensitive credentials such as API Tokens and SSH Keys, investigate any abnormal activities on GitHub and CI, and upgrade to the fixed version 2026.4.1.
You may also like
Should You Buy Bitcoin Now? What the Data Says After a 50% Pullback
Should you buy Bitcoin now? Explore Bitcoin's nearly 50% pullback, ETF outflows, on-chain data, Strategy's BTC sale, and historical trends to assess whether July 2026 is a buying opportunity.
Founder of Baixing.com: I believe half of the statement that large language models devour everything
The internet has been shouting for so many years about devouring everything. Has it really devoured everything now? Is it the internet that devours everything, or is it the large models that devour everything? Both are devouring, and nothing is left?
A "legal" robbery? Attackers emptied the BonkDAO treasury by buying tickets
Handing over the keys to the vault to a public vote where "anyone can spend money to participate," without sufficient oversight mechanisms, even the most legitimate governance ideals may turn into the most convenient tools for attackers.
How has Binance's stock business performed in the 30 days since its launch?
Emerging market buying supported the first wave of demand.
WEEX P2P now supports BDT & LKR—Merchant Recruitment Now Open
To make crypto deposits easier, WEEX has officially launched its P2P trading platform and continues to expand fiat support. We're excited to announce that the Bangladeshi Taka (BDT) and Sri Lankan Rupee (LKR) are now available on WEEX P2P!
Morning News | SK Hynix officially launches the marketing promotion process for its U.S. stock listing; the Central Cyberspace Administration announces the results of the first phase of rectifying AI application chaos, with over 14,000 non-compliant pr...
July 6 Market Important Events Overview
Can Open USD support Stripe's ambitions?
Stripe collaborates with multiple parties to launch OUSD, not only challenging the dominance of USDC but also exposing its trillion-dollar ambition to transition from a "payment interface" to a "next-generation funds settlement network."
Blockchain Capital Partner: AI is rewriting the fundamental unit of labor
The rise of AI is rewriting the basic unit of labor from "positions" and "companies" to "tasks." When programmable labor meets programmable currency, a production line without companies, salary systems, or HR becomes possible for the first time.
The cryptocurrency industry has become a traditional industry
For entrepreneurs and retail investors still in this industry, they should either embrace the current changes or explore the next unpredictable field in cryptocurrency.
Chip frenzy cooling down? Morgan Stanley's Wilson: Funds are shifting towards AI supercomputing giants like Microsoft and Amazon
Morgan Stanley's chief equity strategist Wilson pointed out that the momentum in the semiconductor sector is waning, with the Philadelphia Semiconductor Index having dropped nearly 14% from its peak. Funds are shifting towards AI supercomputing giants like Microsoft, Amazon, and Meta, as well as sec...
Morning Report | Vitalik outlines Ethereum's long-term roadmap, Lean Ethereum will become the third major iteration; SK Hynix seeks to attract more AI investors by listing in the U.S
July 5 Market Important Events Overview
Trump, the best stock trader among U.S. presidents
Trump has almost turned the presidency into a business and maximized the conversion of presidential influence into commercial profits.
From ByteDance to Financial Freedom: How did "Byte Brother" Leto develop his investment judgment skills to achieve a turnaround of 30 million?
Speak with data and signals, validate judgments with A/B tests, and seek asymmetric returns with limited risk exposure.
Selling coins despite a loss of 55 million dollars, the faith in Strategy has reached the interest payment date
The moment faith was securitized, Bitcoin became a bill.
OUSD False Cooperation Controversy? The Credit Game of Stablecoins and Endorsements by Giants
The success of stablecoins does not rely on rallying a group of alliance members for marketing, but rather on whether they have real use cases and genuine users.
Q-Day Countdown: Will Quantum Computing End Cryptocurrency?
In the face of dormant coins being plundered by quantum computing power, should we firmly uphold the unalterable bottom line of "code is law," or should we enforce a soft fork to freeze legacy assets?
The ten years of Cloud on the Air: From corner coffee to global financial infrastructure
How did a remittance company grow into a financial infrastructure that can replace SWIFT; when it really reaches this scale, how should stablecoins be positioned for it; and what can AI integrate into this infrastructure?
$10,000 in TRUMP Token vs. $10,000 in Nasdaq: The "Trump Trade" That Actually Worked in 2026
TRUMP Token lost more than 96% after its launch, while Nasdaq stocks and NVIDIA delivered strong gains. Compare what happened to a $10,000 investment and explore why asset fundamentals matter more than market hype.
Should You Buy Bitcoin Now? What the Data Says After a 50% Pullback
Should you buy Bitcoin now? Explore Bitcoin's nearly 50% pullback, ETF outflows, on-chain data, Strategy's BTC sale, and historical trends to assess whether July 2026 is a buying opportunity.
Founder of Baixing.com: I believe half of the statement that large language models devour everything
The internet has been shouting for so many years about devouring everything. Has it really devoured everything now? Is it the internet that devours everything, or is it the large models that devour everything? Both are devouring, and nothing is left?
A "legal" robbery? Attackers emptied the BonkDAO treasury by buying tickets
Handing over the keys to the vault to a public vote where "anyone can spend money to participate," without sufficient oversight mechanisms, even the most legitimate governance ideals may turn into the most convenient tools for attackers.
How has Binance's stock business performed in the 30 days since its launch?
Emerging market buying supported the first wave of demand.
WEEX P2P now supports BDT & LKR—Merchant Recruitment Now Open
To make crypto deposits easier, WEEX has officially launched its P2P trading platform and continues to expand fiat support. We're excited to announce that the Bangladeshi Taka (BDT) and Sri Lankan Rupee (LKR) are now available on WEEX P2P!
Morning News | SK Hynix officially launches the marketing promotion process for its U.S. stock listing; the Central Cyberspace Administration announces the results of the first phase of rectifying AI application chaos, with over 14,000 non-compliant pr...
July 6 Market Important Events Overview
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
