Overview
A malicious version of the Bitwarden CLI npm package (@bitwarden/[email protected]) was identified as part of an ongoing supply chain campaign attributed to a threat actor known as TeamPCP. Discovered by JFrog, Socket, and OX Security, the attack is consistent with the broader Checkmarx supply chain campaign pattern, leveraging a compromised GitHub Action within Bitwarden’s CI/CD pipeline. Notably, the malicious code specifically targeted configurations for AI coding tools — including Claude, Kiro, Cursor, Codex CLI, and Aider — making this a direct threat to AI-assisted software development environments.
Technical Analysis
The attack executed via a preinstall npm hook, triggering a credential stealer before the legitimate package code ever ran. The malicious file bw1.js performed the following actions:
- Credential harvesting — targeted local secrets,
.envfiles, shell history,.sshkeys, GitHub Actions environment variables, cloud provider credentials, and AI coding assistant configuration files. - Encryption and exfiltration — stolen data was encrypted with AES-256-GCM and sent to
audit.checkmarx[.]cx, a domain impersonating the legitimate Checkmarx security vendor. A GitHub repository served as a fallback exfiltration channel. - Lateral movement — if GitHub tokens were discovered, the malware injected malicious Actions workflows into reachable repositories and used harvested npm credentials to push further poisoned package versions downstream.
- Persistence — a single compromised developer token could grant attackers persistent access to every CI/CD pipeline accessible to that developer.
Security researcher Adnan Khan noted this is believed to be the first compromise of an npm package using NPM Trusted Publishing. The string "Shai-Hulud: The Third Coming" found embedded in the package suggests this may be the third iteration of a longer-running campaign.
Framework Mapping
- AML.T0010 (ML Supply Chain Compromise): The attack directly poisoned a widely-used developer CLI package distributed via npm, targeting downstream AI development toolchains.
- AML.T0057 (LLM Data Leakage): AI coding tool configurations — potentially containing API keys, system prompts, and project context — were specifically targeted for exfiltration.
- AML.T0012 (Valid Accounts): Stolen GitHub and npm tokens were weaponised to maintain persistent, legitimate-looking access across CI/CD pipelines.
- LLM05 (Supply Chain Vulnerabilities): The attack exploited the npm package ecosystem as a vector into AI-integrated development environments.
- LLM06 (Sensitive Information Disclosure): Exfiltration of AI tool credentials and configurations constitutes direct sensitive information disclosure from LLM-adjacent tooling.
Impact Assessment
Any developer who installed @bitwarden/[email protected] is at risk of full credential compromise. The blast radius extends to every repository, CI/CD pipeline, and cloud environment accessible via stolen tokens. The targeting of AI coding tools adds a novel dimension: compromised Claude, Cursor, or Codex CLI credentials could expose proprietary codebases, internal prompts, or AI-generated intellectual property. Organisations with AI-assisted development workflows should treat this as a high-severity incident.
Mitigation & Recommendations
- Remove
@bitwarden/[email protected]immediately and pin to a verified clean version. - Rotate all secrets potentially exposed: GitHub tokens, npm tokens, SSH keys, AWS/GCP/Azure credentials, and AI tool API keys.
- Audit GitHub Actions workflows across all accessible repositories for injected or unrecognised steps.
- Enable npm audit and integrity checks in CI/CD pipelines; consider enforcing lockfile integrity.
- Monitor for outbound connections to
audit.checkmarx[.]cxand review recent GitHub commit history for anomalous activity. - Implement StepSecurity or equivalent GitHub Actions hardening to restrict workflow permissions.