Bitwarden CLI npm Package Trojanized via Checkmarx KICS Cascade

@bitwarden/cli npm package version 2026.4.0

Malicious build of Bitwarden CLI was live on npm for roughly 90 minutes (5:57 PM-7:30 PM ET, April 22, 2026) and pulled approximately 334 times; payload `bw1.js` ran on install and harvested GitHub and npm tokens, SSH keys, AWS, GCP, and Azure secrets, GitHub Actions secrets, AI tooling configuration files, environment variables, and shell history; data exfiltrated to public GitHub repositories created under victim accounts; Bitwarden vault data was not accessed

Earlier in the day, attackers compromised the Checkmarx KICS Docker Hub repository; Bitwarden's Dependabot pulled the malicious `checkmarx/kics:latest` image into the Bitwarden CI/CD pipeline, which then signed and published the trojanized CLI; payload contained the marker "Shai-Hulud: The Third Coming" with Dune-themed identifiers