Two Types of npm Supply Chain Attack: What Catches Each

On April 23, 2026, @bitwarden/cli was compromised as part of the ongoing Checkmarx supply chain campaign . Malicious code was injected into version 2026.4.0 via a GitHub Actions workflow in Bitwarden's own CI/CD pipeline. The package had 9 maintainers, nearly 78K weekly downloads, and a behavioral trust score of 92 out of 100. Three days later, this is still being discussed as a "supply chain attack" — which is accurate but flattening. The category is real. The mechanism is completely different