The official Bitwarden CLI package (@bitwarden/cli@2026.4.0) was compromised on npm with a malicious preinstall hook. The attack deploys a 9.7 MB obfuscated credential stealer that targets developer secrets, GitHub Actions environments, and AI coding tool configurations. Stolen data is encrypted with AES-256-GCM and sent to audit.checkmarx.cx, a domain impersonating Checkmarx. When GitHub tokens are found, the malware injects malicious workflows into repositories to extract CI/CD secrets, creating a supply chain attack pivot point.