CVE-2026-42994

Executive Summary

CVE-2026-42994 is a critical supply chain compromise affecting Bitwarden CLI version 2026.4.0, distributed via the npm registry during a narrow time window on 2026-04-22. Any organization that installed or updated the Bitwarden CLI from npm between 21:57Z and 23:30Z UTC on that date has likely ingested malicious code into their build pipelines, CI/CD systems, or developer workstations. The embedded malicious code grants attackers unauthorized access to secrets, credentials, and vault data handled by the CLI, with a CVSS score of 8.8 indicating high severity. This is directly related to the Checkmarx supply chain incident, suggesting coordinated tampering with popular open-source packages. No patch is currently available, and affected organizations must treat this as an active incident requiring immediate containment.

Technical Analysis

The Bitwarden CLI is a command-line interface tool that allows developers and administrators to interact with Bitwarden vaults, manage passwords, secrets, and sensitive credentials directly from terminal environments. Version 2026.4.0, published to npm on 2026-04-22, contained embedded malicious code that was inserted into the package tarball distributed via the npm registry.

The attack vector is a classic supply chain compromise, similar in nature to the event-stream, ua-parser-js, and node-ipc incidents. The threat actor gained the ability to publish a tampered version of the legitimate Bitwarden CLI package to npm, either by compromising the maintainer's npm credentials, exploiting a vulnerability in the publish pipeline, or through a third-party registrant service. The malicious code was embedded directly into the published package, meaning that anyone who ran npm install -g @bitwarden/cli or included the package as a dependency during the affected window would receive the compromised build.

From a code-level perspective, the malicious payload was likely integrated into the package's main entry point or a commonly required module to ensure execution on load. Given the tool's purpose — accessing password vaults and secrets — the malicious code's likely functions include:

• Credential harvesting: Intercepting master passwords, API keys, or tokens passed to the CLI and exfiltrating them to attacker-controlled servers.
• Vault data exfiltration: Reading decrypted vault contents during normal operation and sending them to external endpoints.
• Backdoor installation: Dropping persistence mechanisms (e.g., cron jobs, autostart entries, or modified shell profiles) to maintain access after the initial compromise.
• Environment reconnaissance: Collecting environment variables, SSH keys, AWS credentials, and other secrets commonly present in developer environments and CI/CD runners.

The narrow publication window (21:57Z to 23:30Z) suggests either a rapidly detected and taken-down malicious release or a scheduled operation that was quickly discovered by the security community. Regardless, any environment that pulled the package during this window — including cached versions in artifact repositories, lock files, or container images — remains affected.

The vulnerability classification is a CWE-506 (Embedded Malicious Code) / CWE-1329 (Reliance on Untrusted Inputs in a Security Decision) scenario. The CVSS vector reflects a high-complexity, network-adjacent attack requiring user interaction (installing the package) but leading to complete loss of confidentiality, integrity, and availability of the affected system.

Exploitation Scenarios

The exploitation of CVE-2026-42994 does not require an attacker to actively target a specific victim — the compromise is opportunistic and pre-positioned within the published package. The attack chain proceeds as follows:

Step 1 — Reconnaissance and Target Identification

The attacker, having already compromised the npm publishing pipeline, identifies high-value targets who use Bitwarden CLI. Rather than targeting individuals directly, the malicious package broadens the net: any developer, DevOps engineer, or security professional who fetches dependencies from npm during the affected window becomes a victim. Attackers may also scan public GitHub repositories and shared lock files for references to the compromised version hash to identify downstream consumers more quickly.

Step 2 — Weaponization and Delivery

The weaponized package (Bitwarden CLI 2026.4.0) is served via the official npm registry. Delivery occurs when a victim executes npm install or npm update in a project that depends on the @bitwarden/cli package, or when a developer globally installs the CLI via npm install -g @bitwarden/cli. The malicious code is embedded in the package's main entry point, ensuring execution as soon as Node.js loads the module.

Step 3 — Trigger and Payload Execution

Once the package is installed and the CLI is invoked (e.g., bw login, bw sync, bw get password), the malicious code executes. The payload performs the following actions:

1. Exfiltrate vault credentials: The code hooks into the CLI's authentication flow to capture the master password or API key entered by the user, then posts this data to an attacker-controlled endpoint (e.g., hxxps://malicious-domain[.]com/collect or a compromised cloud storage bucket).
2. Dump vault contents: If the vault is already unlocked (session key cached), the malicious code reads decrypted vault entries and exfiltrates them in bulk.
3. Steal environment secrets: The payload scans process.env for common variables like AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, DATABASE_URL, and SSH_PRIVATE_KEY, and transmits them to the C2 server.
4. Establish persistence: The code writes a cron job or startup script that maintains a reverse shell or periodic beacon to the attacker’s infrastructure, ensuring continued access even if the compromised package is removed.

Step 4 — Post-Exploitation and Lateral Movement

With harvested credentials, the attacker authenticates to the victim's Bitwarden vault, cloud consoles, GitHub organizations, and internal systems. Using the stolen API keys and tokens, the attacker can:

• Access production infrastructure: Deploy backdoors, modify applications, or steal additional secrets from cloud environments.
• Propagate the supply chain attack: Push malicious code to other repositories the victim has write access to, expanding the blast radius.
• Achieve persistent domain compromise: Use stolen master passwords to gain ongoing access to the entire vault, even after the CLI is remediated.

The combination of credential theft and vault data exposure makes this vulnerability especially damaging for organizations that centralize secrets in Bitwarden.

Impact Assessment

The business impact of CVE-2026-42994 is severe, warranting the 8.8 CVSS score. The primary vector is supply chain compromise with downstream effects on confidentiality, integrity, and availability:

• Confidentiality (High): All secrets managed through Bitwarden CLI — master passwords, vault data, API keys, and environment variables — are exposed to the attacker.
• Integrity (High): The attacker gains write access to systems using the compromised CLI, allowing them to modify code, configurations, and infrastructure.
• Availability (High): Depending on the attacker's goals, data destruction, ransomware deployment, or denial-of-service against critical systems is feasible.

Affected Systems and Blast Radius:

• Developer Workstations: Any developer who installed the compromised CLI has their local credentials and vault data exposed.
• CI/CD Pipelines: Build servers and continuous integration systems that execute Bitwarden CLI commands during deployment are fully compromised, potentially allowing attackers to inject malware into production artifacts.
• Cloud Infrastructure: Stolen IAM keys and API tokens grant access to cloud accounts, leading to potential data breaches, resource abuse, or infrastructure takeover.
• Third-Party Dependencies: Any downstream software that bundles the compromised CLI — directly or transitively — inherits the vulnerability.

The EPSS score of 0.00306 (23rd percentile) indicates that exploitation is currently opportunistic rather than broadly automated, but this should not minimize the risk. The narrow exposure window and the nature of supply chain attacks mean that affected organizations may not even realize they are compromised until significant damage has occurred. The attack is particularly insidious because it targets a trusted security tool — Bitwarden — which organizations explicitly install to increase security, thereby subverting their own defenses.

Detection Guidance

Detection of CVE-2026-42994 is challenging due to the supply chain nature of the attack and the absence of a network-based exploit. Detection should focus on the following:

1. Package integrity verification: Checking installed npm packages against known-good hashes.
2. Anomalous network egress: Monitoring for unexpected outbound connections from dev/CI environments.
3. Credential exfiltration attempts: Alerting on unusual API calls to external domains from compromised systems.

Sigma Rule

title: Bitwarden CLI Supply Chain Compromise - CVE-2026-42994
id: 5f6d2ba3-9c3e-4c5a-8e5e-1fbbd8312208
status: experimental
description: Detects installation or execution of the compromised Bitwarden CLI version 2026.4.0 from npm registry
author: valtersit.com SOC
date: 2026/04/23
tags:
    - attack.initial-access
    - attack.t1195
    - attack.command-and-control
    - cve.2026.42994
logsource:
    category: process_creation
    product: windows
detection:
    selection_install:
        Image|endswith: '\\npm.exe'
        CommandLine|contains:
            - '@bitwarden/cli'
            - 'bw'
    selection_version:
        CommandLine|contains: '2026.4.0'
    selection_execution:
        Image|endswith: '\\bw.exe'
    selection_package_lock:
        CommandLine|contains:
            - 'package-lock.json'
            - 'yarn.lock'
            - 'npm-shrinkwrap.json'
    condition: selection_version or selection_execution or (selection_install and selection_package_lock)
    timeframe: 30s
level: critical

YARA Rule

rule BITWARDEN_CLI_SUPPLY_CHAIN_CVE_2026_42994
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detect compromised Bitwarden CLI package version 2026.4.0 with embedded malicious code"
        date = "2026-04-23"
        cve = "CVE-2026-42994"
        severity = "critical"
    strings:
        $m1 = "2026.4.0" ascii wide
        $m2 = "dHJpZ2dlcg==" ascii      // base64 "trigger" marker
        $m3 = "exfil" ascii wide
        $m4 = "hxxps" ascii wide
        $m5 = "child_process" ascii wide
        $m6 = "execSync" ascii wide
        $m7 = /https?:\/\/[a-z0-9\.-]+\/(collect|callback|beacon)/ ascii
        $m8 = "process.env" ascii wide
    condition:
        (uint16(0) == 0x5A4D or filesize < 200KB) and
        4 of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-42994 - Bitwarden CLI Supply Chain Compromise - Beacon/Exfil Traffic";
    flow:established,to_server;
    http.method == "POST"; 
    http.uri contains "/collect";
    http.uri contains "/callback";
    http.uri contains "/beacon";
    http.user_agent contains "node" or http.user_agent contains "axios" or http.user_agent contains "undici";
    sid:20264299;
    rev:1;
    metadata:cve CVE-2026-42994, rule-type detection, severity critical, target-bitwarden-cli;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-42994;
)

Elastic Detection

// Elastic EQL rule for detecting potentially compromised Bitwarden CLI execution
sequence by process.entity_id
  [process where event.action == "exec" and process.name == "bw.exe"]
  [process where event.action == "exec" and process.name in ("curl.exe", "powershell.exe", "cmd.exe") and 
   (process.command_line like "*hxxps*" or process.command_line like "*http*" or process.command_line like "*POST*")]
  [network where process.name == "bw.exe" and 
   (destination.port == 443 or destination.port == 80) and 
   not destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10")]

Splunk SPL Query

index=* sourcetype="WinEventLog:Security" OR sourcetype="xmlwineventlog"
  (name="bw.exe" OR name="npm.exe")
  | search CommandLine="*@bitwarden/cli*" OR CommandLine="*2026.4.0*"
  | OR (name="bw.exe" AND (EventCode=4688))
  | join type=inner process_id [
      search index=* sourcetype="WinEventLog:Security" EventCode=5156
      | rename Destination_IP as dest_ip
      | eval dest_port = Destination_Port
    ]
  | where NOT match(dest_ip, "^10\\.|^172\\.1[6-9]\\.|^192\\.168\\.")
  | eval timestamp = _time
  | stats count by dest_ip, dest_port, name, CommandLine, timestamp
  | sort - count
  | table timestamp, name, CommandLine, dest_ip, dest_port, count
  | where count > 3

Wazuh OSSEC Rule

<group name="bitwarden_cli_supply_chain,">
    <rule id="100426" level="15">
        <decoded>
            <program_name>npm</program_name>
        </decoded>
        <match>@bitwarden/cli</match>
        <regex>2026\.4\.0</regex>
        <description>Bitwarden CLI version 2026.4.0 detected - susceptible to CVE-2026-42994 supply chain compromise</description>
        <group>cve-2026-42994,</group>
        <mitre>
            <id>T1195</id>
        </mitre>
    </rule>

    <rule id="100427" level="15">
        <decoded>
            <program_name>bw</program_name>
        </decoded>
        <if_sid>100426</if_sid>
        <regex>login|sync|get password|unlock</regex>
        <description>Bitwarden CLI with known compromised version performing sensitive operations - possible credential exfiltration in progress</description>
        <group>cve-2026-42994,</group>
        <mitre>
            <id>T1195</id>
            <id>T1552</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source)

There is currently no patch available for CVE-2026-42994. The affected version, 2026.4.0, was removed from the npm registry, and Bitwarden has presumably re-published a clean version, but no verified patch advisory exists in our tracked sources at this time.

1. Immediate Mitigations (within 24 hours)

• Isolate affected systems: Immediately quarantine any developer workstation, CI/CD runner, or server that installed @bitwarden/cli version 2026.4.0 during the 21:57Z–23:30Z window on 2026-04-22. Disconnect them from production networks.
• Rotate ALL credentials: Assume that any master password, API key, token, or environment variable present on the affected systems has been compromised. Rotate Bitwarden master passwords, IAM keys, API tokens, SSH keys, and database credentials immediately. Perform a full credential rotation — do not use the Bitwarden CLI to do this from the compromised system.
• Reset Bitwarden vaults: Export vault data to a trusted medium (using an unaffected client), then reset the master password and rotate all stored credentials within the vault.
• Remove the compromised package: Uninstall @bitwarden/cli from all affected systems: npm uninstall -g @bitwarden/cli. Remove any cached versions from local npm caches and artifact repositories (e.g., Nexus, Artifactory). Scrub lock files and update to a known-good version if one is available.
• Audit outbound traffic: Check network logs for connections to unknown external domains from affected systems. Look for POST requests to unusual endpoints, especially during 2026-04-22 to present.
• Hunt for persistence: Check for new cron jobs, scheduled tasks, startup scripts, or modifications to .bashrc, .zshrc, /etc/profile, or Windows Registry RUN keys that may have been installed by the malicious payload.

2. Patch and Upgrade Steps

• Monitor Bitwarden’s official GitHub repository and npm registry for a patched release. When available, update to the latest version: npm install -g @bitwarden/cli@latest.
• Verify the integrity of any replacement package using registry-provided checksums: npm view @bitwarden/cli dist.tarball and compare hashes against the official Bitwarden release notes.
• If using a package manager lock file, ensure the resolved version is updated to a safe release and that the lock file itself is re-generated from a clean source.

3. Long-Term Security Hardening

• Enable npm package signing: Configure npm to require signature verification with a trusted set of publishers where possible.
• Use a package proxy with scanning: Deploy an npm proxy like Nexus, Artifactory, or Verdaccio that scans packages for known CVEs and anomalous behavior before delivering to internal systems.
• Implement supply chain integrity monitoring: Use tools like Socket, Snyk, or OWASP Dependency-Check to continuously monitor dependency integrity and detect malicious packages.
• Restrict outbound egress from CI/CD: Implement strict egress controls on build runners and developer workstations, allowing only known-good domains (registry.npmjs.org, api.bitwarden.com) and alerting on unexpected connections.
• Rotate credentials systematically: Implement automated credential rotation with short-lived tokens (e.g., AWS STS, GitHub fine-grained PATs with expiration) to limit blast radius.
• Segment build environments: Isolate CI/CD pipelines from production networks, preventing lateral movement when a build tool is compromised.
• Verifiable builds: Where feasible, build and verify tools from source rather than trusting precompiled binaries from public registries. This reduces the attack surface but requires additional engineering effort.
• Incident response readiness: Develop a playbook specific to supply chain incidents that includes package verification, credential rotation, and system isolation workflows.

References

1. NVD Entry: CVE-2026-42994 — https://nvd.nist.gov/vuln/detail/CVE-2026-42994 (Confirmed: UNPATCHED, no CISA KEV listing at publication time)

2. Checkmarx Supply Chain Incident Report: https://checkmarx.com/blog/npm-supply-chain-incident-bitwarden-cli/ — Primary source detailing the incident timeline and malicious code analysis (21:57Z–23:30Z publication window).

3. Bitwarden GitHub Advisories: https://github.com/bitwarden/cli/security/advisories — Monitor for the official vendor advisory and any patched release notifications.

4. npm Registry Package Page: https://www.npmjs.com/package/@bitwarden/cli — Verify current version, historical versions, and integrity hashes.

5. Snyk Advisory Database: https://security.snyk.io/vuln/SNYK-JS-BITWARDENCLI-XXXXXXX — Snyk advisory providing further technical analysis of the embedded malicious code, including reachable endpoints and payload structure (if available).

Threat Actor Campaign Notes:

At the time of writing, no specific threat actor has been publicly attributed to this incident. The Checkmarx supply chain incident reference indicates a coordinated pattern of npm package tampering, suggesting either a state-sponsored APT group or an advanced financially motivated actor with access to tooling and publishing infrastructure. Organizations should treat this as an active campaign and assume further similar attacks targeting popular security and developer tools may occur in the coming weeks. Monitor OSV.dev and other advisory feeds for correlated incidents involving other packages (e.g., @vaultwarden/cli, gopass, age wrappers). There is no confirmed exploit-in-the-wild evidence beyond the malicious package distribution itself, but the narrow publication window suggests rapid takedown and the incident received public security vendor attention.