78
Checkmarx itself is associated with Israeli Occupation Forces, so it shouldn't be used by anyone in the first place.
Can npm just disable the post install script feature at this point jfc, or put a ton of hurdles to jump over in order to use it just to make sure that this is always 100% meant to be there
Did you share a link to the source? When I click on it, it behaves like a picture.
that's because it is a picture. they didn't link a source.
So it only affected users of the CLI (Command Line Interface) for a short period of time, which means the vast majority of users are still safe.
according to a moderator of the Bitwarden community forum, “it seems that only 334 Bitwarden users downloaded the malicious version of the CLI,” during the time it was available.
Like most supply chain attacks, it’s targeting developers and other people who use tooling like this rather than Bob and Alice on the street.
Same here, using the default web interface, but this bug seems to happen sometimes on Lemmy: half the people see a link and the other half just an image. OP probably did post a link.
I posted a link and upload a picture. But it looks like it change the link to the link of the picture I have changed it now.
Damn.
I'll stick with my keepass + syncthing combo
This was a supply chain attack, everything is vulnerable to this type of attack.
For a small window of time if you downloaded an update it had malware. It also looks like a lot of those downloads were bot downloads. There is no evidence that vaults have been compromised.
In a post on X, JFrog said the rogue version of the package "steals GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets, then exfiltrates the data to private domains and as GitHub commits."
Of what app? Keepass? Was from the Debian repos. Syncthing what's from the syncthing repos
Of Bitwarden.
this is why i'm so wary of switching to password managers despite them being so practical.
this post was submitted on 24 Apr 2026
78 points (98.8% liked)
Privacy
48317 readers
583 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS