A malicious npm package published as @bitwarden/cli version 2026.4.0 executes a multi-stage payload that steals credentials from cloud providers, CI/CD systems, and developer workstations, and self-propagates by backdooring every npm package the victim can publish.
| Vendor | Product | Versions |
|---|---|---|
| bitwarden | cli | 2026.4.0 |
