---
id: 2443
title: "Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise"
published_at: "2026-04-23 00:00"
tags: ["cloud", "supply-chain", "credential-theft", "npm", "ci-cd", "supply-chain-security", "worm", "shai-hulud", "bitwarden"]
phying_url: "https://phying.com/item/2443"
lang: en
---

# Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm

## Summary

A malicious @bitwarden/cli release carried a self-propagating worm self-named 'Shai-Hulud: The Third Coming', harvesting SSH keys, cloud secrets, and MCP configs via Bitwarden's compromised CI pipeline.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-04-23 00:00
- **Original:** https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
- **Phying News:** https://phying.com/item/2443