3c:I[58016,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"ProcessEpisodeButton"] 3e:I[185,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"SendEmailButton"] 3f:I[45269,["/_next/static/chunks/0jjo8hz~ewue4.js","/_next/static/chunks/0abq8zp15pmva.js","/_next/static/chunks/05gz47kazl1ze.js","/_next/static/chunks/139o5utivfajl.js","/_next/static/chunks/0a~e7k..h6jfc.js","/_next/static/chunks/0d1e9m2ig9v3v.js","/_next/static/chunks/0fg30bidui1gn.js","/_next/static/chunks/0rizq9ux3s1w3.js","/_next/static/chunks/0bbc2ioe2xmkf.js","/_next/static/chunks/0z7avafhgjcyr.js"],"SignupCTA"] 36:["$","div",null,{"className":"flex flex-col gap-2 text-sm text-muted-foreground","children":[["$","span",null,{"className":"inline-flex items-center gap-2 bg-secondary/50 px-3 py-1 rounded-full","children":[["$","svg",null,{"className":"w-4 h-4","fill":"none","stroke":"currentColor","viewBox":"0 0 24 24","children":["$","path",null,{"strokeLinecap":"round","strokeLinejoin":"round","strokeWidth":2,"d":"M8 7V3m8 4V3m-9 8h10M5 21h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z"}]}],["$","time",null,{"dateTime":"2026-04-29T08:00:00.000Z","children":"Wed Apr 29 2026"}]]}],null]}] 3d:T50e,

On April 22, 2026, the Bitwarden CLI, used in CI/CD pipelines at tens of thousands of organizations, was weaponized for exactly 93 minutes.

In this episode, Darnley walks through the anatomy of the supply chain attack that compromised bitwarden cli version 2026.4.0: how the threat group exploited a compromised Checkmarx GitHub Action to inject credential-stealing malware into Bitwarden's npm publishing pipeline, what the worm actually stole, how it self-propagated by republishing victims own npm packages, and why the fact that "no vault data was compromised" misses the point...

Packed with practical technical guidance on pipeline hardening, package pinning, least-privilege, and the one npm setting that could have blocked this attack entirely...this episode is essential listening for developers, IT security teams, and anyone responsible for a software supply chain who need to hear it.

Click here to send future episode recommendation

Support the show

Subscribe now to Darnley's Cyber Cafe and stay informed on the latest developments in the ever-evolving digital landscape.

Bitwarden CLI Hacked? The Supply Chain Attack That Targeted 250K Developers