41:I[185,["/_next/static/chunks/08z4tkzvltetr.js","/_next/static/chunks/121~yigv24_j6.js","/_next/static/chunks/0jo3du-icy6v2.js","/_next/static/chunks/15cy49d~_zsjj.js","/_next/static/chunks/0..ktetnpeix7.js","/_next/static/chunks/0_htf5~kl..m1.js","/_next/static/chunks/0i6hzvr84kc1r.js"],"SendEmailButton"] 43:I[63625,["/_next/static/chunks/08z4tkzvltetr.js","/_next/static/chunks/121~yigv24_j6.js","/_next/static/chunks/0jo3du-icy6v2.js","/_next/static/chunks/15cy49d~_zsjj.js","/_next/static/chunks/0..ktetnpeix7.js","/_next/static/chunks/0_htf5~kl..m1.js","/_next/static/chunks/0i6hzvr84kc1r.js"],"AddToLibraryButton"] 44:I[29721,["/_next/static/chunks/08z4tkzvltetr.js","/_next/static/chunks/121~yigv24_j6.js","/_next/static/chunks/0jo3du-icy6v2.js","/_next/static/chunks/15cy49d~_zsjj.js","/_next/static/chunks/0..ktetnpeix7.js","/_next/static/chunks/0_htf5~kl..m1.js","/_next/static/chunks/0i6hzvr84kc1r.js"],"ShareButton"] 45:I[58016,["/_next/static/chunks/08z4tkzvltetr.js","/_next/static/chunks/121~yigv24_j6.js","/_next/static/chunks/0jo3du-icy6v2.js","/_next/static/chunks/15cy49d~_zsjj.js","/_next/static/chunks/0..ktetnpeix7.js","/_next/static/chunks/0_htf5~kl..m1.js","/_next/static/chunks/0i6hzvr84kc1r.js"],"ProcessEpisodeButton"] 46:I[45269,["/_next/static/chunks/08z4tkzvltetr.js","/_next/static/chunks/121~yigv24_j6.js","/_next/static/chunks/0jo3du-icy6v2.js","/_next/static/chunks/15cy49d~_zsjj.js","/_next/static/chunks/0..ktetnpeix7.js","/_next/static/chunks/0_htf5~kl..m1.js","/_next/static/chunks/0i6hzvr84kc1r.js"],"SignupCTA"] 3b:["$","div",null,{"className":"flex flex-wrap items-center gap-x-4 gap-y-1 font-mono text-[12px] uppercase tracking-[0.1em] text-[color:var(--fg-3)]","children":[["$","time",null,{"dateTime":"2026-04-29T08:00:00.000Z","children":"April 29, 2026"}],["$","span",null,{"aria-hidden":true,"children":"·"}],["$","span",null,{"children":"00:21:31"}],false]}] 42:T50e,

On April 22, 2026, the Bitwarden CLI, used in CI/CD pipelines at tens of thousands of organizations, was weaponized for exactly 93 minutes.

In this episode, Darnley walks through the anatomy of the supply chain attack that compromised bitwarden cli version 2026.4.0: how the threat group exploited a compromised Checkmarx GitHub Action to inject credential-stealing malware into Bitwarden's npm publishing pipeline, what the worm actually stole, how it self-propagated by republishing victims own npm packages, and why the fact that "no vault data was compromised" misses the point...

Packed with practical technical guidance on pipeline hardening, package pinning, least-privilege, and the one npm setting that could have blocked this attack entirely...this episode is essential listening for developers, IT security teams, and anyone responsible for a software supply chain who need to hear it.

Click here to send future episode recommendation

Support the show

Subscribe now to Darnley's Cyber Cafe and stay informed on the latest developments in the ever-evolving digital landscape.