Shai-Hulud Rides Again: The Bitwarden CLI Compromise and the Cascade We're Now Living In
On April 22, 2026, @bitwarden/cli@2026.4.0 was published with a credential-stealing payload — via a GitHub Action that was itself compromised in the Checkmarx breach a month earlier. The cascade is not a metaphor; it is the mechanism. Why supply chain velocity is outpacing upstream defenses, and why runtime enforcement is the only surface attackers cannot bypass.