TL;DR: A malicious Bitwarden CLI package ran during npm install before inspection, according to Canyon Road, targeting GitHub, npm, SSH and cloud secrets, CI secrets, and AI tooling configuration. The incident shows that post-install review is too late when agents and CI pipelines can execute installs automatically and inherit poisoned context.
At a glance
What this is: A malicious Bitwarden CLI package ran during npm install and targeted developer, CI, cloud, and AI-tooling secrets before users could inspect it.
Why it matters: This matters because install-time execution creates a supply chain control gap for CI systems and AI-enabled developer workflows that can act before human review.
Context
The core problem is execution-time trust in software supply chains: a package can run code during installation before anyone has a chance to inspect it. In developer and CI environments, that means the control boundary is not the repository, but the install step itself.
That risk gets sharper when the same environment is used by CI pipelines, bots, and coding assistants. A poisoned package can execute in unattended workflows and then shape what the next tool sees, including shell state and agent configuration. Treat CI/CD pipeline identity security as part of the same problem space, not a separate one.
Key questions
Q: What breaks when package installation can execute code before review?
A: The control that breaks is the assumption that installation is a safe administrative step. If package hooks can run during build or setup, then malware can execute before static review, credential scanning, or policy checks finish. That creates a gap where the package name looks acceptable but the runtime behaviour is already hostile. Teams need to govern execution paths, not just dependency lists.
Q: Why do broad CI/CD and agent permissions increase supply chain risk?
A: Broad permissions turn a single compromised package, token, or tool into a reusable path across publishing, deployment, and adjacent systems. When build identities are not task-scoped, attackers can alter artefacts or trigger actions that defenders never intended to expose. Narrowing scope limits how far one trusted input can travel.
Q: What are the signs that a package compromise has moved beyond theft?
A: Look for persistence artefacts, repeated token validation, unexpected LaunchAgents or systemd services, and unusual file drops in developer directories. Those indicators suggest the attacker is maintaining access rather than simply exfiltrating data. If those signs exist, the incident should be treated as an endpoint compromise, not just a bad dependency.
Q: Should teams prioritise install-time enforcement or runtime detection first?
A: Install-time enforcement should come first when the compromise can trigger before the package manager returns control. Runtime detection still matters, but it is compensating control after execution has started. If the control boundary is the install step, prevention there reduces both secret exposure and downstream workflow poisoning.
Technical breakdown
Why preinstall scripts are the real execution boundary
npm packages can execute lifecycle scripts such as preinstall before the install completes, which means code runs while trust is still being established. In this case, the payload rewired entrypoints and downloaded a second-stage loader, so the risky moment was not post-install use but the install itself. That is why package review after installation cannot prevent execution already triggered by the package manager. The security issue is not only malicious code, but malicious code that arrives in a trusted workflow primitive. See the Malicious Package and Dependency Confusion Guide.
Practical implication: Enforce package-install controls at execution time, not after installation has finished.
Why developer and agent workflows widen the blast radius
A human installer can sometimes notice a bad package in time, but CI fleets, auto-update bots, and agent-driven sandboxes can trigger installs repeatedly and without oversight. That turns a short exposure window into a repeatable path. The agentic risk is not autonomy in the abstract, but that runtime systems keep acting after the first command boundary. When a workflow can install, test, spawn child processes, and continue without a human gate, the same malicious package can reach many environments quickly.
Practical implication: Treat unattended install workflows as high-risk execution paths and govern them separately from interactive developer sessions.
How shell profiles become context poisoning surfaces
The incident did more than seek secrets on disk. It also wrote into shell profile files, which matters because coding assistants may read those files to learn the environment. That creates a context-poisoning path: even inert text can shape what an assistant sees and how it behaves next. This is different from classic persistence, where the attacker wants code to rerun. Here the objective is to influence the next runtime consumer, including an LLM-backed tool that interprets the workspace. See the AI Coding Agents Security Guide.
Practical implication: Scan shell profiles and agent configuration files as input surfaces, not just persistence artifacts.
Threat narrative
Attacker objective: The attacker sought to harvest developer and CI secrets while also shaping the next tool or assistant that would consume the poisoned environment.
- Entry occurred when the malicious @bitwarden/cli package was distributed through the npm delivery path and executed during npm install.
- Credential access followed as the payload searched for GitHub and npm tokens, SSH keys, shell history, .env files, cloud credentials, CI secrets, and AI tooling configuration.
- Impact extended beyond theft because the payload also touched shell profile files and attempted to poison the environment read by downstream assistants.
Breaches seen in the wild
- Bitwarden CLI npm compromise 2026: A malicious Bitwarden CLI on npm, linked to the Checkmarx campaign, targeted GitHub, npm, cloud and CI secrets from developers for 90 minutes.
- Code Formatting Tools Credential Leaks: Widely used code formatting tools cause massive credential and secrets leaks in enterprise environments.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Install-time execution is the control boundary, not post-install inspection: This incident shows that package trust collapses at the moment lifecycle scripts run. If a malicious payload can execute in preinstall, then review after installation is structurally too late. The implication is that supply chain governance has to treat execution triggers as the policy point, not the package registry alone.
Agentic workflows turn short exposure windows into persistent operational risk: A single malicious package is damaging because CI fleets, bots, and agents can replay the same install path at scale. That is a governance problem because unattended execution removes the natural friction a human would provide. CI/CD pipeline identity security becomes part of software supply chain defence when installs are automated.
Shell profiles are no longer just persistence files, they are context surfaces: The meaningful twist in this incident is the attempt to place text into files that assistants may read next. That changes the control assumption from 'can the file execute?' to 'can the file influence the model or tool that ingests it?' Practitioners need to recognise this as context poisoning, not just persistence.
Execution-layer security is the missing assurance layer for modern toolchains: The article’s central lesson is that static detection alone cannot stop a package that has already begun to run. Deterministic controls at execution time are now a requirement for environments where installs, tests, and child processes happen continuously. The practitioner takeaway is to govern side effects while code is running, not after the fact.
From our research library:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- Read next: Malicious Package and Dependency Confusion Guide
What this signals
Execution-layer supply chain control: The meaningful shift here is that package trust is now an execution problem, not just a provenance problem. If installs can trigger code, then your guardrails need to observe and govern the install boundary itself, including child processes and network calls that occur during setup.
When AI tooling consumes shell state and workspace files, the attack surface expands from secret theft to behavioural influence. That means teams should treat agent configuration, shell profiles, and developer automation as part of the same control plane, especially where unattended workflows can repeat the same poisoned path.
For practitioners
- Block package execution at install time Require policy enforcement before lifecycle scripts run, especially for npm, pip, and yarn paths that can execute automatically during installation.
- Separate unattended workflows from interactive sessions Treat CI, bot-driven updates, and agent sandboxes as distinct execution zones with tighter controls than a developer laptop.
- Inventory AI tool configuration files Include ~/.claude.json, ~/.claude/mcp.json, and similar agent settings in secret and integrity scans because they shape downstream tool behaviour.
- Monitor shell profiles as input surfaces Review .bashrc, .zshrc, and other shell startup files for unexpected content that could influence assistants or runtime tooling.
Key takeaways
- The incident shows that supply chain compromise is now an execution-time governance problem, not only a repository integrity problem.
- Its value as evidence is in the narrow blast radius and the broad set of secrets it still targeted, including CI and AI-tooling assets.
- Practitioners should move enforcement to the install boundary and treat shell profiles and agent settings as security-sensitive inputs.
Related NHI Mgmt Group resources: Malicious Package and Dependency Confusion Guide · CI/CD Pipeline Identity Security Guide · AI Coding Agents Security Guide · AI Supply Chain Security and AI-BOM Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The payload targeted tokens, SSH keys, .env files, and AI config during execution. |
| NHI-03 — Vulnerable Third-Party NHI | A poisoned npm package acted as a third-party identity and trust source in the supply chain. | |
| NHI-06 — Insecure Cloud Deployment Configurations | The malware sought cloud credentials and CI secrets from runtime environments. | |
| Recommendation — Scan install paths for leaked NHI secrets and revoke any exposed credentials immediately. Review third-party package trust paths and block untrusted execution before install scripts run. Harden cloud and CI execution environments so package installs cannot reach sensitive credentials. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The attack centered on credential harvesting and likely exfiltration during install-time execution. |
| Recommendation — Map install-time package abuse to credential access and exfiltration detections in your telemetry. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about controlling what code may execute in privileged build and agent paths. |
| Recommendation — Restrict package-install permissions so only approved execution paths can run in CI and agent workflows. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The incident touches identity controls for CI, cloud, and developer automation. |
| Recommendation — Apply IAM governance to CI and automation identities that can install packages and access secrets. | ||
Key terms
- Install-Time Execution: Install-time execution is code that runs while dependencies are being installed rather than when an application is launched. In supply chain attacks, this matters because the install phase often has access to the richest secrets in developer and CI environments, making it a high-value privilege boundary.
- Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
- Execution boundary: The point at which an authorised task turns into a real system change, such as writing data, deleting records, spending money, or invoking a downstream tool. In AI governance, controlling the execution boundary matters more than simply approving access, because harm occurs when actions are allowed to complete unchecked.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org