# Malware Hid in Bitwarden's CLI for 90 Minutes — Hunting Your AI Bot's Saved Keys **URL:** \ **Category:** News & Articles\ **Tags:** hacking, privacy, tips-tricks, ai, news\ **Created:** [June 29, 2026, 2:46pm UTC](https://onehack.st/t/malware-hid-in-bitwardens-cli-for-90-minutes-hunting-your-ai-bots-saved-keys/323486 "2026-06-29T14:46:28Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Jenna](https://onehack.st/user_avatar/onehack.st/jenna/32/166322_2.png) [@Jenna](https://onehack.st/u/Jenna)\ **Post date:** [June 29, 2026, 2:46pm UTC](https://onehack.st/t/malware-hid-in-bitwardens-cli-for-90-minutes-hunting-your-ai-bots-saved-keys/323486/1 "2026-06-29T14:46:29Z")
# 🚨 Malware Hid in Bitwarden’s CLI for 90 Minutes — and It Was Hunting Your AI Bot’s Saved Keys _OKAY SO a hacker crew slipped poison into the exact tools that nerds use to STAY safe — and the bullseye wasn’t your photos. It was your AI assistant’s password._ **The receipts: A malicious copy of the Bitwarden tool sat live for ~90 minutes. The Checkmarx tool that got hit has 5,000,000+ downloads. 96 gigabytes of private company files ended up dumped on a leak site. And the stolen keys cascaded all the way into OpenAI and Vercel.** A crew calling itself **TeamPCP** spent two months quietly backdooring trusted developer tools. The wild part? The malware skipped your selfies and went straight for the little hidden files where your AI coding helpers (Claude Code, Cursor, Aider) keep their login keys. First reported by [SecurityWeek](https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/), [Sophos](https://www.sophos.com/en-us/blog/supply-chain-attacks-hit-checkmarx-and-bitwarden-developer-tools), and [Microsoft Security](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/). ![hacker code](https://media.giphy.com/media/RbDKaczqWovIugyJmW/giphy.gif) > **🧩 Dumb Mode Dictionary (read this first, takes 20 seconds)** > > | Scary Word | What It Actually Means | > | --- | --- | > | **Supply chain attack** | Instead of robbing your house, they poison the delivery truck. You install a trusted tool, the poison comes free. | > | **CLI** | A “type-commands-instead-of-clicking” version of an app. Nerds love it. | > | **npm package** | A free Lego brick of code that devs download. Millions use the same brick. | > | **Token / SSH key / credential** | A saved password your computer uses so YOU don’t have to log in every time. Steal it = skip the login. | > | **Exfiltrate** | Fancy word for “quietly copy your stuff out the back door.” | > | **AI coding tool** | A bot (Claude Code, Cursor, Aider) that writes code for you. It logs in with a saved key — that’s what got stolen. | > **📰 How we got here (the 2-month slow burn)** > > This wasn’t a smash-and-grab. TeamPCP played the long game: > > - **Late Feb 2026** — They got into **Trivy** (a super-popular free security scanner) because somebody forgot to fully rotate an old password. Classic. > - **April 22** — They pushed a poisoned **Bitwarden CLI** (`@bitwarden/cli` version 2026.4.0) onto npm. It was live for about **90 minutes** (5:57 PM → 7:30 PM ET). Tiny window, huge blast. > - **Same day** — They tampered with **Checkmarx KICS** , a tool with **5 million+ downloads** , sneaking bad versions under normal-looking tags like `latest`. > - **April 28** — **96 GB** of Checkmarx’s private files showed up on the LAPSUS$ extortion site. Yikes. > > Full timeline breakdown lives at [gblock.app](https://www.gblock.app/articles/teampcp-supply-chain-checkmarx-bitwarden-trivy) and [Endor Labs](https://www.endorlabs.com/learn/shai-hulud-the-third-coming----inside-the-bitwarden-cli-2026-4-0-supply-chain-attack). > **🧠 The genuinely scary new part: it hunted the AI bots** > > Here’s the bit that made senior engineers sit up straight. > > Old-school malware grabs everything and sorts it later. This one had a **shopping list**. It specifically went looking for the hidden config files of authenticated AI coding tools: > > - Claude Code > - Cursor > - Codex CLI > - Aider > - Kiro > - Gemini CLI > > Why? Because your AI helper logs into expensive services on your behalf — and it stores that login key in plain sight on your machine. Steal the AI’s key and you inherit its powers (and its bill). Per [State of Surveillance](https://stateofsurveillance.org/news/bitwarden-cli-supply-chain-attack-ai-coding-tools-checkmarx-2026/), this is the first big wave treating _the AI’s saved login_ as the prize. Plus the usual loot: GitHub tokens, SSH keys, shell history, cloud passwords. > **📊 The damage, by the numbers** > > | Thing | Number | > | --- | --- | > | How long the poisoned Bitwarden tool was live | ~90 minutes | > | Downloads on the hit Checkmarx tool | 5,000,000+ | > | Private data dumped on leak site | 96 GB | > | Tools backdoored | 3 (Trivy, Bitwarden CLI, Checkmarx) | > | Big names hit downstream | OpenAI, Vercel | > | AI tools specifically targeted | 6 | > **🗣️ What the timeline's saying** > > - **Devs:** “I pulled `latest` that afternoon. Cool. Cool cool cool.” (rotating every key they own as we speak) > - **Security folks:** the scary lesson isn’t one bad file — it’s that ONE poisoned brick flows into thousands of companies before anyone notices. > - **Normal people reading this:** “wait, my AI app stores its password… just sitting in a file on my laptop?” Yeah. Yeah it does. Welcome. > - The reused playbook (called “Shai-Hulud” by researchers) keeps coming back — [SecurityWeek’s writeup](https://www.securityweek.com/bitwarden-npm-package-hit-in-supply-chain-attack/) calls it a pattern, not a one-off. #### Cool. So Trusted Tools Can Be Poisoned and AI Keys Are Now Loot… Now What the Hell Do We Do? (ง •̀\_•́)ง ![padlock security](https://media.giphy.com/media/YQitE4YNQNahy/giphy.gif) Look — most of you aren’t getting hacked tomorrow. But this whole mess just opened a bunch of doors that nobody’s standing in front of yet. Here’s where the quiet money and the smart moves are hiding (before everyone catches on). > **🪟 The Patch-Window Janitor** > > Every time one of these poisonings drops, thousands of small dev shops have NO idea if they pulled the bad version. There’s a 2-4 week panic window where everyone’s asking “am I affected?” and nobody has time to check. You become the person who checks. > > You don’t need to be a hacker — you need a checklist and a calm voice. Free tools like [Trivy itself](https://github.com/aquasecurity/trivy) (the clean version) and [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) literally scan for known-bad packages for free. You run the scan, you hand them a one-page “you’re clean / you’re cooked” report. > > 🧠 _Example:_ A 24-year-old freelancer in Lagos watches the [npm advisories feed](https://github.com/advisories), DMs small startups within hours of each new poisoning, and charges a flat $150 for a “did-this-hit-you” audit. 6 clients in a bad week. > > > 📈 **Timeline:** First paying check within a week of the next incident. Dries up about 3 weeks after each scare — so you ride the news cycle, not a steady salary. > **🔑 The Key-Rotation Concierge** > > Here’s a thing 90% of small teams know they SHOULD do and never actually do: change all their saved login keys after a scare. It’s boring, it’s fiddly, everyone procrastinates. That procrastination is your product. > > You build (or honestly, just hand-write) a dead-simple step-by-step “rotate everything in 30 minutes” guide for GitHub, AWS, npm, and the big AI tools. Sell the guide. Upsell doing it _for_ them over a screen-share. The free reference to build it from is [GitHub’s own token docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure) and [AWS’s rotation guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). > > 🧠 _Example:_ A part-time IT student in Manila sells a “Panic Button Key-Rotation Kit” PDF on [Gumroad](https://gumroad.com) for $12, then charges $60 to walk a founder through it live. Pure boredom arbitrage. > > > 📈 **Timeline:** Sales spike for ~10 days after every headline. Build 3-4 kits for different stacks so you’re never empty-handed. > **🤖 The AI-Key Lockdown Guy** > > This is the fresh one nobody’s selling yet. Millions of people just installed Claude Code, Cursor, Aider — and almost NONE of them know their login key sits in a plain file. You become the person who locks that file down. > > The play: a tiny, friendly walkthrough on moving those AI keys into a proper locked vault and setting them to auto-expire, so a stolen file = a useless file. The real docs you’d build this on are public — [Anthropic’s API key best-practices](https://docs.anthropic.com/en/api/getting-started) and any free secrets manager like [Doppler](https://www.doppler.com) or [Infisical (open source)](https://github.com/Infisical/infisical). > > 🧠 _Example:_ A bootcamp grad in São Paulo posts a 4-minute “your AI bot’s password is naked, here’s the fix” video, links a $9 setup checklist, and slides into indie-hacker Discords. First mover on a worry nobody’s named yet. > > > 📈 **Timeline:** Tiny niche today, big in 6 months as more people clock that AI keys are the new target. Plant the flag now while it’s empty. > **📡 The Early-Warning Whisperer** > > Security news is loud, scattered, and written in nerd. Busy founders don’t have time to read 6 security blogs. So you become their 60-second filter. One job: “if a tool you use gets poisoned, you hear it from me first, in plain English.” > > You watch a handful of free feeds — [GitHub Advisories](https://github.com/advisories), [The Hacker News](https://thehackernews.com/), [BleepingComputer](https://www.bleepingcomputer.com/) — and the SECOND something relevant drops, you ping your list with “this affects you, here’s the 2-minute fix.” Not a newsletter about everything. A heads-up about _their_ stuff only. > > 🧠 _Example:_ A 22-year-old in Pune runs a free WhatsApp broadcast for 40 local startup founders, builds total trust, then charges $20/month for “tell me only what affects my exact tools.” Word-of-mouth does the rest. > > > 📈 **Timeline:** Free trust-building for the first month, paid by month two. Plateaus around 50-100 subscribers solo — that’s the ceiling before you’d need help. > **🕳️ The Dependency Detective (grey-hat flavored)** > > Spicier one. These attacks work because thousands of projects blindly trust packages with weak owners — abandoned accounts, no two-factor login, one maintainer who hasn’t logged in since 2023. That weakness is _findable_ in public data, totally legally. > > You comb public package registries for popular bricks sitting on fragile foundations, write up “here’s a soft target before someone poisons it” reports, and sell them to companies that depend on those bricks — OR responsibly report to the maintainers for [bug bounty](https://www.hackerone.com) payouts. Same skill, two paydays. Start with the public [npm](https://www.npmjs.com) and [OpenSSF Scorecard](https://github.com/ossf/scorecard) data. > > 🧠 _Example:_ A self-taught researcher in Cairo runs OpenSSF Scorecard across a company’s dependency list, finds 3 packages with zero two-factor protection, and reports it for a $400 bounty. Repeatable across any target with a public package list. > > > 📈 **Timeline:** First finding in days if you’re sharp. The easy targets get cleaned up over ~2 months, so the low-hanging fruit has a real shelf life — move while it’s ripe. > **🛠️ Follow-Up Actions** > > | If you want to… | Do this | > | --- | --- | > | Scan your own stuff for bad packages | Run [Trivy](https://github.com/aquasecurity/trivy) or [Dependency-Check](https://owasp.org/www-project-dependency-check/) — free | > | Lock your AI tool keys in a vault | Try [Infisical](https://github.com/Infisical/infisical) or [Doppler](https://www.doppler.com) | > | Get warned when a tool you use is hit | Follow [GitHub Advisories](https://github.com/advisories) + [BleepingComputer](https://www.bleepingcomputer.com/) | > | Earn from finding weak packages | Sign up at [HackerOne](https://www.hackerone.com) bounties | > | Sell a panic-fix kit | Spin up a [Gumroad](https://gumroad.com) page in 10 minutes | **⚡ Quick Hits** | You Want | You Do | | --- | --- | | 🔍 Check if you pulled a bad version | Scan with [Trivy](https://github.com/aquasecurity/trivy) today | | 🔑 Stop your AI key from being naked loot | Move it into [Infisical](https://github.com/Infisical/infisical) + set it to expire | | 📡 Never get blindsided again | Bookmark [GitHub Advisories](https://github.com/advisories) | | 💰 Turn this panic into pocket money | Sell a key-rotation kit on [Gumroad](https://gumroad.com) | | 🧠 Understand the full attack | Read the [TeamPCP breakdown](https://www.gblock.app/articles/teampcp-supply-chain-checkmarx-bitwarden-trivy) | _The malware didn’t want your password. It wanted the password your robot uses — and your robot left it lying on the floor._