babe wake up, new supply chain attack just dropped.
npm `@bitwarden/cli` version `2026.4.0` has already been yanked/deprecated, but it was malware that would steal any and all secrets/tokens/API keys it could find.
https://research.jfrog.com/post/bitwarden-cli-hijack
it was live for less than 14 hours (idk how long exactly; might've been significantly less than 14 hours)
[discussion at Twitter](https://twitter.com/JFrogSecurity/status/2047268576071991766)
sodiboo :pride_heart:
npub1j3…ry2uc
2026-04-23 14:29:31 UTC
Author Public Key
npub1j3w0f8cxz6rkt7jen58z9paevv9yne883xnt0xrew5zkakelns2sxry2ucSeen on
wss://relay.momostr.pinkPublished at
2026-04-23 14:29:31 UTCEvent JSON
{
"id": "22e5f92ac07d680f523a406f1d2e36fdfc82dc7c57c25ef1a934ebec5a6d5bd9",
"pubkey": "945cf49f06168765fa599d0e2287b9630a49e4e789a6b7987975056edb3f9c15",
"created_at": 1776954571,
"kind": 1,
"tags": [
[
"proxy",
"https://gaysex.cloud/notes/alf56o41b3if0006",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://gaysex.cloud/notes/alf56o41b3if0006",
"pink.momostr"
],
[
"-"
]
],
"content": "babe wake up, new supply chain attack just dropped.\n\nnpm `@bitwarden/cli` version `2026.4.0` has already been yanked/deprecated, but it was malware that would steal any and all secrets/tokens/API keys it could find.\n\nhttps://research.jfrog.com/post/bitwarden-cli-hijack\n\nit was live for less than 14 hours (idk how long exactly; might've been significantly less than 14 hours)\n\n[discussion at Twitter](https://twitter.com/JFrogSecurity/status/2047268576071991766)",
"sig": "d3cb7c1577b0eb62dcd265eed3f1bb0eb03a0cbc44c512f88233a17df143880746b773880ecea43343a2fc23ba7af85489df35b9ae23918e16cfa183d6e854af"
}