Bitwarden CLI compromised (News)

Summary of Bitwarden CLI compromised (News)

by Changelog Media

8m•April 29, 2026
Listen to Episode

Overview of Bitwarden CLI compromised

This week’s Changelog News covers a mix of major open source and platform updates, plus a serious supply-chain security incident. The biggest alert is that the official Bitwarden CLI was compromised in a malicious npm package campaign, with credential-stealing behavior aimed at developers and CI environments. Other highlights include Warp going open source, TypeScript 7 entering beta with a major performance rewrite, Ubuntu 26.04 LTS shipping, Ruby getting a native compiler via Spinal, and pg_backrest being archived after 13 years.

Major Security Alert: Bitwarden CLI Compromised

  • Bitwarden’s official CLI was published maliciously to npm as part of the ongoing “checkmarks” supply-chain campaign.
  • The compromised tool was designed to scrape sensitive secrets from developer machines and CI runners, including:
    • GitHub tokens
    • AWS, Azure, and GCP credentials
    • npm config
    • SSH keys
    • Shell profiles
    • Claude and MCP config files
  • The malicious package also exfiltrated data through a spoofed audit.checkmarks.cx endpoint.
  • The warning is urgent: if bw / Bitwarden CLI was used on a dev machine or CI runner recently, treat it as an incident response scenario, not a routine update.

Product and Platform Updates

Warp goes open source

  • Warp, the terminal app, is now open source.
  • The company says open sourcing will help them ship faster and collaborate more effectively with the community.

TypeScript 7 Beta

  • TypeScript 7 reached beta after more than a year of work.
  • The compiler core was rewritten in Go, replacing the JavaScript bootstrap approach.
  • The headline benefit is roughly 10x faster performance than TypeScript 6.
  • Stable release is expected within about two months.
  • The team recommends using it in daily workflows and CI pipelines now.

Ubuntu 26.04 LTS ships

  • Ubuntu 26.04 LTS, “Resolute Raccoon,” is now available.
  • This LTS is intended to support systems for the next five years.
  • Canonical notably paused the planned Rust core utilities swap, which signals a more conservative, stable LTS direction.
  • If you manage fleets or VMs, now is the time to plan your upgrade path.

Developer Tooling and Language News

Spinal compiles Ruby to native binaries

  • Mats (the Ruby creator) released Spinal, an ahead-of-time compiler for Ruby.
  • It converts Ruby source into standalone C, then builds native binaries via GCC or Clang.
  • Reported performance gains:
    • Around 11.6x faster in general benchmarks
    • Up to 86x faster on compute-heavy workloads like Conway’s Game of Life
  • Practical use cases highlighted:
    • Small CLIs
    • Serverless functions
    • Short-lived processes
  • The takeaway: Ruby may now have a more serious “native” lane alongside its dynamic runtime.

Infrastructure and Operations

pg_backrest is no longer maintained

  • pg_backrest, a widely used PostgreSQL backup tool, has been archived after 13 years.
  • Maintainer David Steele has stepped away and stated he does not want to continue doing the work poorly or sporadically.
  • The important implication: no more maintenance means no future security patches.
  • Teams relying on pg_backrest in production should treat this as a near-term action item and plan a migration.

Sponsored Segment Takeaway: Why cloud dev environments matter

  • The sponsored discussion with Coder focused on the security and consistency benefits of cloud development environments.
  • Main points:
    • Local laptops are fragile and hard to standardize.
    • Developers often drift into inconsistent setups, causing “works on my machine” problems.
    • Cloud environments can enforce package sources and reduce exposure to public supply-chain attacks.
    • If a dev environment is compromised, cloud setups can be reset quickly, minimizing downtime and blast radius.

Action Items

  • If you use Bitwarden CLI: investigate immediately for compromise and rotate exposed credentials.
  • If you maintain dev tooling or CI: review dependency trust boundaries and supply-chain protections.
  • If you use pg_backrest: start planning a backup strategy migration now.
  • If you manage Ubuntu fleets: schedule testing for Ubuntu 26.04 LTS.
  • If you use TypeScript: consider testing the TypeScript 7 beta in CI and daily workflows.
  • If you build with Ruby: evaluate whether Spinal could fit CLI or compute-heavy native use cases.