Bitwarden CLI Compromised  🔗 **Source:** [Bitwarden CLI Compromised](https://share.snipd.com/episode/98f43984-98e5-4ee6-82e0-576b8dd29766) ## Highlights - **Respond Immediately If You Ran The Bitwarden CLI** - Treat a compromised CLI as an incident response, not a normal patch cycle. - If you ran bw on developer machines or CI recently, Adam urges immediate incident response because the malicious build scraped sensitive files via a spoofed audit endpoint. Transcript: Adam Stacoviak Bitwarden CLI has been compromised. Yes, Bitwarden's official command line tool got hit last Thursday. Our friends at Socket are on the beat. They flagged a malicious CLI published to NPM as part of the same checkmarks themed supply chain campaign that's been going through developer tooling this past few weeks. Here's what matters. The CLI is now the tool by definition that sits next to our secrets. And the compromise build was scraping GitHub tokens, AWS, Azure and GCP credentials, NPM config, SSH keys, the good stuff, right? Shell profiles, and even your cloud andcp config files out of the spoofed audit.checkmarks endpoint. So if you ran Bitwarden or BW the command on a dev machine or a CI runner in the past few weeks, this is an incident response. This is not a patch cycle. And our friends at Socket say, quote, the compromise follows the same GitHub action supply chain vector identified in the broader checkmarks campaign. End quote. So this is a strategic attack and our dev tools are in the crosshairs. ([Time 0:00:48](https://share.snipd.com/snip/9c47192e-63c9-4cfe-8547-fe88ec6338be)) - **CLI Tools Are A Prime Supply-Chain Target** - Command-line tools are high-risk because they sit next to secrets and can exfiltrate tokens and keys. - Adam Stacoviak describes the compromised Bitwarden CLI scraping GitHub tokens, cloud creds, npm config, SSH keys, shell profiles, and cloud config files. Transcript: Adam Stacoviak Bitwarden CLI has been compromised. Yes, Bitwarden's official command line tool got hit last Thursday. Our friends at Socket are on the beat. They flagged a malicious CLI published to NPM as part of the same checkmarks themed supply chain campaign that's been going through developer tooling this past few weeks. Here's what matters. The CLI is now the tool by definition that sits next to our secrets. And the compromise build was scraping GitHub tokens, AWS, Azure and GCP credentials, NPM config, SSH keys, the good stuff, right? Shell profiles, and even your cloud andcp config files out of the spoofed audit.checkmarks endpoint. So if you ran Bitwarden or BW the command on a dev machine or a CI runner in the past few weeks, this is an incident response. This is not a patch cycle. And our friends at Socket say, quote, the compromise follows the same GitHub action supply chain vector identified in the broader checkmarks campaign. End quote. So this is a strategic attack and our dev tools are in the crosshairs. ([Time 0:00:48](https://share.snipd.com/snip/946edd03-284c-4635-b27a-d3e5cc7abd81)) - **Compromise Followed A Known GitHub Action Vector** - The Bitwarden compromise reused a broader GitHub Actions vector tied to the Checkmarx-themed campaign. - Adam notes Socket traced the malicious release to the same supply-chain GitHub Action vector used in other recent attacks. Transcript: Adam Stacoviak And our friends at Socket say, quote, the compromise follows the same GitHub action supply chain vector identified in the broader checkmarks campaign. End quote. So this is a strategic attack and our dev tools are in the crosshairs. ([Time 0:01:43](https://share.snipd.com/snip/db931d06-2417-44f5-aaf3-71390725d73a)) - **TypeScript 7 Rewrote The Compiler For Speed** - TypeScript 7.0 moved from a JS bootstrap compiler to a Go rewrite to break a performance ceiling. - Adam highlights the rewrite yields about 10x faster compile times versus 6.0 and is declared ready for CI and daily workflows. Transcript: Adam Stacoviak TypeScript 7.0 beta. TypeScript 7.0 hit beta last Tuesday. After more than a year of porting from a JavaScript-based bootstrap compiler to a Go rewrite, the team is shipping it with one headline number, about 10x faster than 6.0. The big picture, this is the most ambitious thing TypeScript has done since the language shipped. Microsoft didn't add features, they rewrote the core in a different language to break a performance ceiling that javascript bootstrap tsc was never going to clear and they say stable Is within the next two months daniel ross and wazzer typescript program manager from microsoft says this quote it is highly stable highly compatible and ready to put to the test in your Daily workflows in ci pipelines today so you got your marching orders use it in your workflows today use it in your pipelines today and enjoy TypeScript 7.0. ([Time 0:01:59](https://share.snipd.com/snip/bc03fd42-1833-4e7d-b5c5-c4a164f87ac6)) - **Resolute Raccoon Arrives For Long Term Fleets** - Ubuntu 26.04 LTS (Resolute Raccoon) shipped as an LTS supporting fleets through April 2036. - Adam says he uses Ubuntu in VMs/containers and plans to update templates from 24.04 to 26.04 for long-term fleet upgrades. Transcript: Adam Stacoviak It in your pipelines today and enjoy TypeScript 7.0. Ubuntu 26.04 LTS is here. Okay. So Resolute Raccoon shipped on Thursday. Fantastic news for our home labbers out there who are on the edge of Ubuntu. I know that's what I use in my VMs and containers, so I'm excited to finally get my templates updated to Ubuntu 26.04 up from 24.04. This is the LTS release your service will run for the next five years on through April 2036. ([Time 0:02:51](https://share.snipd.com/snip/3f13b5c9-6aeb-4a0f-9dd8-30cba7f684b1)) - **Use Cloud Dev Environments To Shrink Attack Surface** - Reduce dev-machine risk by using cloud development environments and restrict package sources to vetted private registries. - Nicky Pike recommends killing and restarting cloud dev environments to recover quickly instead of waiting weeks for a laptop replacement. Transcript: Adam Stacoviak Well, I'm here with Nicky Pike from Coder.com. Secure environments where devs and agents work in parallel. Nicky, the thing on my mind this week is the laptop. Nicky Pike How secure, how at risk are we? The laptop is the, is the trap here. And not only because the fact that it could be stolen, you could lose it, it breaks, and you're out of work while you're waiting for a new one. But there's also just the consistency that you got there. We all know developers. Developers are going to be looking for some of the latest and greatest. And if you're not really controlling how they get out there, that's where you get this. It works on my machine. It doesn't work in production. It doesn't work anywhere else because you don't have that consistency. You don't have that ability to really standardize what that environment looks like. But there's also the security and the supply chain aspect of this. When you have local machines out there, look at like the Shai Halud, you know, that virus that went out not long ago. This was a compromise of the NPM public repositories. They went and downloaded things. NPM did what it did. Next thing you know, you're compromised. But when you use something like what we're doing with cloud development environments, then you can mandate and you can put restrictions on there to say, hey, you can only go get your Packages from our private repo. Those packages are expected to have been thoroughly vetted. We know that they're clean. Now, does this stop everything like Shai Halud? No. If that compromised package gets into your private repo, you can still have that. But it really reduces the surface area of the attack. And it also reduces the blast area of the compromise should it happen. Because if your laptop gets compromised and you have to kill the laptop for whatever reason, that's weeks out of work while you're either fixing that or you're getting a new laptop in. The cloud development environments allows you to kill that, start back up fresh, and you're back and running in five minutes. ([Time 0:03:50](https://share.snipd.com/snip/155229e0-4016-47fb-8c5b-f6156dc73720)) - **Spinel Makes Ruby Viable For Small Fast Binaries** - Matz released Spinel, an ahead-of-time Ruby compiler that emits C to produce native binaries and dramatically reduces startup costs. - Adam reports benchmarks showing ~11.6x median speedups and up to 86x on compute-heavy tasks like Conway's Game of Life. Transcript: Adam Stacoviak Spinal compiles Ruby to native binaries. Our favorite programmer, Matt, drops Spinal on Friday. Thank you, Matt, of course, for Ruby. It is an ahead of time compiler that takes Ruby source, emits standalone C and runs it through DCC or C line to produce a native binary. And the benchmarks say it's about 11.6x faster. And on compute heavy workloads, Conway's Game of Life is the canonical example, and it tops 86x. And if you ask me, this changes the framing for what Ruby can be used for. The immediate obvious win is small CLIs, lambda functions, and short-lived processes. Basically, anywhere CRuby's startup cost was a tax to you and pushed you to Go or Rust, now Ruby is an option. And here's the cool thing. Ruby on more serious infrastructure. The cleanest read of this is that Matt is signaling Ruby's future has a typed precompiled lane next to its dynamic one. The Crystal community has been making this case for years. But the difference is this one's coming from Matt himself. ([Time 0:05:40](https://share.snipd.com/snip/04e50173-905a-4715-8d52-ef7a4747bfa2)) - **Migrate Away From pgBackRest Immediately** - If you run pgBackRest in production, act now: migrate or find an alternative because the maintainer archived the repo. - Adam warns pgBackRest will not be patched after David Steele's hard stop, impacting backups and disaster recovery plans. Transcript: Adam Stacoviak PG backrest is no longer being maintained. After 13 years, David Steele has stepped away from PG Backrest. The repository is archived. The REBEE leaves with, quote, notice of obsolescence, end quote. The standard backup tool for production postcard deployments has lost its maintainer and won't be patched going forward. This is not a hobby crate gone dormant. PG Backrest is a tool a lot of operations teams have woven into the fabric of what they do. Their runbooks, their backup automation, their disaster recovery plans. And when the next CVE hits and this maintainer's gone, it's not getting patched. Not eventually, not at all. The sentiment can be read directly from David Steele, quote, rather than do the work poorly and or sporadically, I think it makes sense to have a hard stop, end quote. David, good for you to call the ball, draw the line, and step away as you need to. So if you run PG Backrest in production, this is a this week task. Don't delay it. And who knows what's to come for PG Backrest. ([Time 0:06:46](https://share.snipd.com/snip/835ef585-2436-4a3f-a5bf-0093af6818b5))