Bitwarden Statement on Checkmarx Supply Chain Incident
community.bitwarden.com
The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/[email protected] between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious ...
  • Nibodhika@lemmy.worldEnglish
    1·
    11 hours ago

    That article has lots of issues:

    17% of the most popular Rust packages contain code that virtually nobody knows what it does

    That’s not true at all, the article where he got that information from says:

    Only 8 crate versions straight up don’t match their upstream repositories. None of these were malicious: seven were updates from vendored upstreams (such as wrapped C libraries) that weren’t represented in their repository at the point the crate version was published, and the last was the inadvertent inclusion of .github files that hadn’t yet been pushed to the GitHub repository.

    So, of the 999 most popular crates analyzed 0% contains code nobody knows what it does.

    He then lists some ways packages can be maliciously compromised:

    1. Steal credentials and impersonate a dev
    2. Misleading package names
    3. Malicious macros (this one is interesting, had never considered it before)
    4. Malicious build script

    And his solutions are:

    1. Bigger std library (solves none of the above)
    2. Source dependencies (solves none of the issues he showed, only the issue that happens in 0% of packages where binary doesn’t match the source and is detectable)
    3. Decentralized packages (which worsens every security concern)
    4. Centralized Checksum database (so a centralized package manager is bad, but a centralized Checksum index is good? How does that work?)

    Honestly I can’t take that article seriously, it grossly misinterpreted another study, presents problems that exist on every single package manager ever, doesn’t propose ANY valid solution, and the only thing he points to as a solution suffers from ALL of the same issues and then some.