CVE-2026-42994
CVSS 9.8 CRITICAL: bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. EPSS 0.3% (22nd percentile).
Vulnerabilities & Exploits · Supply Chain
The real break was not a code flaw. A trusted npm install path was turned into a short-lived secret-harvesting event, and by the time CVE-2026-42994 showed up in dashboards, the credential theft window was already closed. A clean SCA view did not mean the developer machine or CI runner was clean.
Bitwarden CLI version 2026.4.0 was on npm for about 90 minutes on April 22 and carried a payload that harvested AWS, Azure, GCP, GitHub, and npm tokens from systems that ran npm install. The malicious release reached Bitwarden’s publishing path through a compromised GitHub Action tied to the Checkmarx supply-chain incident, then received CVE-2026-42994 about nine days later.
This shifts the meaning of the event. The important control is incident response for exposed secrets, not just vulnerability tracking for a package version, because the loss already happened before tooling could label it.
1 source · May 20
CVSS 9.8 CRITICAL: bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. EPSS 0.3% (22nd percentile).
CSO Online
Why some security fixes never reach your vulnerability dashboard
CVE was built to track code flaws with fixes. It’s now being stretched to cover malware and supply chain incidents that don’t fit. Agent infrastructure and AI assets are where that drift becomes structural.
originalPart of the PlainSec briefing for 2026-05-20
Every edition of this story: Malicious npm Release Exposed Secrets Before CVE Appeared