Gate News message, April 24 — Bitwarden CLI version 2026.4.0 was compromised in a supply chain attack between 17:57 and 19:30 ET on April 24, according to SlowMist CISO 23pds. Attackers exploited GitHub Actions in Bitwarden’s CI/CD pipeline to inject a malicious package that was briefly distributed via npm.
The attack targeted the repository’s continuous integration workflow, allowing unauthorized code to reach the package registry. However, Bitwarden confirmed that Vault data was not compromised, production systems were unaffected, and only users who installed version 2026.4.0 from npm during the 1.5-hour window were impacted.
Bitwarden advised affected users to immediately uninstall version 2026.4.0, clear npm cache, rotate API tokens and SSH keys, audit GitHub and CI activity for anomalies, and upgrade to the patched version 2026.4.1.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Litecoin Suffers Deep Chain Reorganization After MWEB Zero-Day Exploit, Erasing Three Hours of History
Gate News message, April 26 — Litecoin experienced a deep chain reorganization (reorg) on Saturday after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The bug allowed mining nodes running older software to
GateNews5h ago
Apecoin Insider Turns $174K Into $2.45M in One Day With 14x Trade on Both Sides of 80% Surge
An anonymous wallet with no prior trading history turned $174,000 worth of ether into $2.45 million by trading Apecoin on both sides of an 80% price surge in a single day.
Key Takeaways:
Wallet 0x0b8a converted $174,000 in ETH into a leveraged Apecoin long, exiting near the top for a $1.79M
Coinpedia5h ago
Hong Kong Police Dismantle Cross-Border Fraud Ring Targeting Overseas Students, Seizing HK$5M in Assets
Gate News message, April 26 — Hong Kong police have dismantled a cross-border fraud ring that targeted overseas Chinese students studying abroad, according to local media. The syndicate impersonated law enforcement officials and coerced victims into traveling to Hong Kong to purchase gold bars as "c
GateNews5h ago
Litecoin Reorg Undoes MWEB Privacy Layer Exploit
Litecoin underwent a deep chain reorganization on Saturday after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The incident resulted in a three-hour reorg that erased invalid transactions from the
CryptoFrontier11h ago
North Korean IT Workers Laptop Farm Scam: US Co-Conspirator Sentenced to 7–9 Years, Netting $2.8 Billion Over Two Years
Fortune reported that North Korea used laptop farms inside the United States, generating about $2.8 billion in revenue over two years to support nuclear weapons; annual tribute is $250–600 million. The U.S. citizen suspects Kejia Wang and Zhenxing Wang were each sentenced to 7.5 years and 9 years, respectively, for involvement exceeding 100 companies and 80 cases of identity theft. North Korea operated in the U.S. using U.S. identities and fixed devices, with funds mostly being converted via cryptocurrencies. Experts warn that an accomplice network still exists inside the country, and companies must strengthen identity verification, address tracking, and time zone/IP analysis.
ChainNewsAbmedia14h ago
Hong Kong Police Warn of Surge in Crypto Scams; Two Women Lose $1.24M in Recent Weeks
Gate News message, April 25 — Two Hong Kong women lost a combined HK$9.7 million (US$1.24 million) to crypto scammers over recent weeks, prompting local police to issue a public warning. Hong Kong police reported more than 80 fraud cases in a single week, with total losses exceeding HK$80 million (U
GateNews15h ago
