Bitwarden CLI Hit by Supply Chain Attack Through GitHub Actions

Researchers reported a supply-chain attack that injected a credential-stealing payload into the Bitwarden CLI npm package (@bitwarden/cli v2026.4.0) via a compromised GitHub Actions workflow. The malware harvests GitHub tokens, cloud credentials (AWS/Azure/GCP), npm tokens, and SSH keys, persists via shell profile modification, avoids execution on Russian locales, and exfiltrates stolen data by publishing it to public GitHub repositories (with Dune-themed names); IOCs include the malicious package, C2 IP 94.154.172.43, and https://audit.checkmarx.cx/v1/telemetry.