Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm

A malicious 2026.4.0 release of the npm package `@bitwarden/cli` (published via a compromised CI/CD pipeline) installs a multi-stage credential-stealing worm that harvests SSH keys, cloud secrets (AWS, GCP, Azure), npm/GitHub tokens, and other developer secrets, exfiltrates data to public GitHub repositories and to `audit.checkmarx.cx`, and propagates by publishing/reusing stolen tokens; the report includes payload/preinstall SHA256 hashes, filenames, C2 URLs, and remediation/detection guidance.