Malicious npm Release Exposed Secrets Before CVE Appeared
The real break was not a code flaw. A trusted npm install path was turned into a short-lived secret-harvesting event, and by the time CVE-2026-42994 showed up in dashboards, the credential theft window was already closed. A clean SCA view did not mean the developer machine or CI runner was clean.
Bitwarden CLI version 2026.4.0 was on npm for about 90 minutes on April 22 and carried a payload that harvested AWS, Azure, GCP, GitHub, and npm tokens from systems that ran npm install. The malicious release reached Bitwarden’s publishing path through a compromised GitHub Action tied to the Checkmarx supply-chain incident, then received CVE-2026-42994 about nine days later.
This shifts the meaning of the event. The important control is incident response for exposed secrets, not just vulnerability tracking for a package version, because the loss already happened before tooling could label it.