The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/
[email protected] between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious ...
so many workplaces I have been at used npm.
We just recently switched from npm to pnpm, due to all the supply chain attacks. I did the PR for it, even.
Our release schedule is like a year though so we don’t really have to worry much about releasing compromised dependencies. But still, better to be on the safer side.
Yep. And so many workplaces have had security vulnerabilities caused by dumb decisions that could have been easily avoided