The attack compromised @bitwarden/cli@2026.4.0 by leveraging a compromised GitHub Action in Bitwarden's CI/CD pipeline. Malicious code was published in 'bw1.js' file included in the package contents. The threat actors used stolen GitHub tokens to inject a new GitHub Actions workflow that captures secrets available to the workflow run, and used harvested npm credentials to push malicious versions of the package. This appears to be the first time a package using NPM trusted publishing has been compromised. The malicious package steals GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets, then exfiltrates the data to private domains and as GitHub commits.