The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/
[email protected] between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious ...
Wait, any package that I download via NPM could potentially have a script that will run unless I set it to false, when I install said package?
Yes, that is exactly how the axios supply chain attack worked… It ran post install script (on dependency) that downloaded malware, ran it and even cleaned it up. Everything on that machine was compromised… It can be any dependency of dependency too, deep down in the tree…
Hmm. I was going to say that it sounds bonkers what it can run just any script, but at the same time, is it any different from downloading and executhing a binary file?