The Bitwarden CLI Just Got Backdoored. Here's What the Supply Chain Attack Actually Did.

Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware. This was not a phishing campaign. Nobody tricked a Bitwarden employee into clicking a link. The attackers walked straight through the CI/CD pipeline, injected malicious code into an official release, and let Bitwarden's own npm publishing mechanism do the distribution for them. The Problem It's Solving (For the Attackers) Supply chain attacks are effective precis