Malware Hid in Bitwarden’s CLI for 90 Minutes — and It Was Hunting Your AI Bot’s Saved Keys
Malware Hid in Bitwarden’s CLI for 90 Minutes — and It Was Hunting Your AI Bot’s Saved KeysOKAY SO a hacker crew slipped poison into the exact tools that nerds use to STAY safe — and the bullseye wasn’t your photos. It was your AI assistant’s password.
The receipts: A malicious copy of the Bitwarden tool sat live for ~90 minutes. The Checkmarx tool that got hit has 5,000,000+ downloads. 96 gigabytes of private company files ended up dumped on a leak site. And the stolen keys cascaded all the way into OpenAI and Vercel.
A crew calling itself TeamPCP spent two months quietly backdooring trusted developer tools. The wild part? The malware skipped your selfies and went straight for the little hidden files where your AI coding helpers (Claude Code, Cursor, Aider) keep their login keys. First reported by SecurityWeek, Sophos, and Microsoft Security.
🧩 Dumb Mode Dictionary (read this first, takes 20 seconds)
| Scary Word | What It Actually Means |
|---|---|
| Supply chain attack | Instead of robbing your house, they poison the delivery truck. You install a trusted tool, the poison comes free. |
| CLI | A “type-commands-instead-of-clicking” version of an app. Nerds love it. |
| npm package | A free Lego brick of code that devs download. Millions use the same brick. |
| Token / SSH key / credential | A saved password your computer uses so YOU don’t have to log in every time. Steal it = skip the login. |
| Exfiltrate | Fancy word for “quietly copy your stuff out the back door.” |
| AI coding tool | A bot (Claude Code, Cursor, Aider) that writes code for you. It logs in with a saved key — that’s what got stolen. |
📰 How we got here (the 2-month slow burn)
This wasn’t a smash-and-grab. TeamPCP played the long game:
- Late Feb 2026 — They got into Trivy (a super-popular free security scanner) because somebody forgot to fully rotate an old password. Classic.
- April 22 — They pushed a poisoned Bitwarden CLI (
@bitwarden/cliversion 2026.4.0) onto npm. It was live for about 90 minutes (5:57 PM → 7:30 PM ET). Tiny window, huge blast. - Same day — They tampered with Checkmarx KICS, a tool with 5 million+ downloads, sneaking bad versions under normal-looking tags like
latest. - April 28 — 96 GB of Checkmarx’s private files showed up on the LAPSUS$ extortion site. Yikes.
Full timeline breakdown lives at gblock.app and Endor Labs.
🧠 The genuinely scary new part: it hunted the AI bots
Here’s the bit that made senior engineers sit up straight.
Old-school malware grabs everything and sorts it later. This one had a shopping list. It specifically went looking for the hidden config files of authenticated AI coding tools:
- Claude Code
- Cursor
- Codex CLI
- Aider
- Kiro
- Gemini CLI
Why? Because your AI helper logs into expensive services on your behalf — and it stores that login key in plain sight on your machine. Steal the AI’s key and you inherit its powers (and its bill). Per State of Surveillance, this is the first big wave treating the AI’s saved login as the prize. Plus the usual loot: GitHub tokens, SSH keys, shell history, cloud passwords.
📊 The damage, by the numbers
| Thing | Number |
|---|---|
| How long the poisoned Bitwarden tool was live | ~90 minutes |
| Downloads on the hit Checkmarx tool | 5,000,000+ |
| Private data dumped on leak site | 96 GB |
| Tools backdoored | 3 (Trivy, Bitwarden CLI, Checkmarx) |
| Big names hit downstream | OpenAI, Vercel |
| AI tools specifically targeted | 6 |
🗣️ What the timeline's saying
- Devs: “I pulled
latestthat afternoon. Cool. Cool cool cool.” (rotating every key they own as we speak) - Security folks: the scary lesson isn’t one bad file — it’s that ONE poisoned brick flows into thousands of companies before anyone notices.
- Normal people reading this: “wait, my AI app stores its password… just sitting in a file on my laptop?” Yeah. Yeah it does. Welcome.
- The reused playbook (called “Shai-Hulud” by researchers) keeps coming back — SecurityWeek’s writeup calls it a pattern, not a one-off.
Cool. So Trusted Tools Can Be Poisoned and AI Keys Are Now Loot… Now What the Hell Do We Do? (ง •̀_•́)ง
Look — most of you aren’t getting hacked tomorrow. But this whole mess just opened a bunch of doors that nobody’s standing in front of yet. Here’s where the quiet money and the smart moves are hiding (before everyone catches on).
🪟 The Patch-Window Janitor
Every time one of these poisonings drops, thousands of small dev shops have NO idea if they pulled the bad version. There’s a 2-4 week panic window where everyone’s asking “am I affected?” and nobody has time to check. You become the person who checks.
You don’t need to be a hacker — you need a checklist and a calm voice. Free tools like Trivy itself (the clean version) and OWASP Dependency-Check literally scan for known-bad packages for free. You run the scan, you hand them a one-page “you’re clean / you’re cooked” report.
Example: A 24-year-old freelancer in Lagos watches the npm advisories feed, DMs small startups within hours of each new poisoning, and charges a flat $150 for a “did-this-hit-you” audit. 6 clients in a bad week.
Timeline: First paying check within a week of the next incident. Dries up about 3 weeks after each scare — so you ride the news cycle, not a steady salary.
🔑 The Key-Rotation Concierge
Here’s a thing 90% of small teams know they SHOULD do and never actually do: change all their saved login keys after a scare. It’s boring, it’s fiddly, everyone procrastinates. That procrastination is your product.
You build (or honestly, just hand-write) a dead-simple step-by-step “rotate everything in 30 minutes” guide for GitHub, AWS, npm, and the big AI tools. Sell the guide. Upsell doing it for them over a screen-share. The free reference to build it from is GitHub’s own token docs and AWS’s rotation guide.
Example: A part-time IT student in Manila sells a “Panic Button Key-Rotation Kit” PDF on Gumroad for $12, then charges $60 to walk a founder through it live. Pure boredom arbitrage.
🤖 The AI-Key Lockdown Guy
This is the fresh one nobody’s selling yet. Millions of people just installed Claude Code, Cursor, Aider — and almost NONE of them know their login key sits in a plain file. You become the person who locks that file down.
The play: a tiny, friendly walkthrough on moving those AI keys into a proper locked vault and setting them to auto-expire, so a stolen file = a useless file. The real docs you’d build this on are public — Anthropic’s API key best-practices and any free secrets manager like Doppler or Infisical (open source).
Example: A bootcamp grad in São Paulo posts a 4-minute “your AI bot’s password is naked, here’s the fix” video, links a $9 setup checklist, and slides into indie-hacker Discords. First mover on a worry nobody’s named yet.
📡 The Early-Warning Whisperer
Security news is loud, scattered, and written in nerd. Busy founders don’t have time to read 6 security blogs. So you become their 60-second filter. One job: “if a tool you use gets poisoned, you hear it from me first, in plain English.”
You watch a handful of free feeds — GitHub Advisories, The Hacker News, BleepingComputer — and the SECOND something relevant drops, you ping your list with “this affects you, here’s the 2-minute fix.” Not a newsletter about everything. A heads-up about their stuff only.
Example: A 22-year-old in Pune runs a free WhatsApp broadcast for 40 local startup founders, builds total trust, then charges $20/month for “tell me only what affects my exact tools.” Word-of-mouth does the rest.
🕳️ The Dependency Detective (grey-hat flavored)
Spicier one. These attacks work because thousands of projects blindly trust packages with weak owners — abandoned accounts, no two-factor login, one maintainer who hasn’t logged in since 2023. That weakness is findable in public data, totally legally.
You comb public package registries for popular bricks sitting on fragile foundations, write up “here’s a soft target before someone poisons it” reports, and sell them to companies that depend on those bricks — OR responsibly report to the maintainers for bug bounty payouts. Same skill, two paydays. Start with the public npm and OpenSSF Scorecard data.
Example: A self-taught researcher in Cairo runs OpenSSF Scorecard across a company’s dependency list, finds 3 packages with zero two-factor protection, and reports it for a $400 bounty. Repeatable across any target with a public package list.
🛠️ Follow-Up Actions
| If you want to… | Do this |
|---|---|
| Scan your own stuff for bad packages | Run Trivy or Dependency-Check — free |
| Lock your AI tool keys in a vault | Try Infisical or Doppler |
| Get warned when a tool you use is hit | Follow GitHub Advisories + BleepingComputer |
| Earn from finding weak packages | Sign up at HackerOne bounties |
| Sell a panic-fix kit | Spin up a Gumroad page in 10 minutes |
Quick Hits
| You Want | You Do |
|---|---|
 Check if you pulled a bad version |
Scan with Trivy today |
 Stop your AI key from being naked loot |
Move it into Infisical + set it to expire |
 Never get blindsided again |
Bookmark GitHub Advisories |
 Turn this panic into pocket money |
Sell a key-rotation kit on Gumroad |
| Understand the full attack |
Read the TeamPCP breakdown |
The malware didn’t want your password. It wanted the password your robot uses — and your robot left it lying on the floor.
!