Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

A malicious npm release of @bitwarden/cli (2026.4.0) delivered a preinstall-hook credential stealer (bw1.js) that targeted developer, CI/GitHub, and cloud secrets, encrypted them with AES-256-GCM, and exfiltrated data to audit.checkmarx.cx and fallback GitHub repositories; stolen GitHub tokens were used to inject malicious Actions workflows and publish additional malicious packages as part of an ongoing Checkmarx-linked supply-chain campaign attributed to TeamPCP.