logoalt Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

805 points • by tosh • yesterday at 2:17 PM • 384 comments • view on HN

Comments

jeremie_strand • yesterday at 6:29 PM

[dead]

gcolella • today at 12:30 PM

[dead]

Ms-J • today at 12:13 AM

[dead]

asxndu • yesterday at 3:46 PM

[dead]

ripped_britches • yesterday at 4:28 PM

I have been meaning to move off of Bitwarden. In the past, open source meant more secure. Still could be the case for super important projects, but that is just no longer reality. I’m considering just vibe coding my own, vibe pentesting it, and keeping it private.

rvz • yesterday at 3:28 PM

Once again, it is in the NPM ecosystem. OneCLI [0] does not save you either. Happens less with languages that have better standard libraries such as Go.

If you see any package that has hundreds of libraries, that increases the risk of a supply chain attack.

A password manager does not need a CLI tool.

[0] https://news.ycombinator.com/item?id=47585838

➕ show 6 replies