The official Bitwarden CLI package (@bitwarden/cli@2026.4.0) on npm was compromised with malicious code that installs a credential stealer targeting developer secrets, GitHub Actions, and AI tool configurations. The malware uses a preinstall hook to bootstrap the Bun JavaScript runtime and execute a 9.7 MB obfuscated payload. Stolen data is encrypted with AES-256-GCM and sent to audit.checkmarx.cx, a domain impersonating Checkmarx. When GitHub tokens are found, the malware injects malicious workflows into repositories to extract CI/CD secrets, creating a supply chain attack vector.