← statichum.studio

Local-Workstation npm Preinstall-Hook Quarantine Layer For Solo Devs And AI-Coding-Agent Users After The April 22 2026 Bitwarden CLI Wormable Attack

dev tool real project ••• trending

On April 22 2026 the malicious @bitwarden/cli@2026.4.0 published for 90 minutes, fired its preinstall hook on every npm install during the window, and silently exfiltrated AWS, GCP, GitHub, npm tokens, SSH material, shell history, and AI-coding-assistant config files into attacker-controlled commits. Existing supply-chain tooling (Socket, Snyk, Dependabot) is CI-centric and runs after install. The gap is a sub-second wrapper on the developer's laptop that intercepts npm/pnpm/yarn install, runs preinstall scripts in a syscall-sandbox, blocks outbound network during postinstall, and blasts a notification if any package tries to read ~/.aws/, ~/.ssh/, .env, or the Cursor/Claude Code/Codex config dirs. Indie devs and freelancers (who don't have a corporate SOC) want this.

builder note

Don't try to be Snyk. The wedge is the laptop experience: a 200-line wrapper that aliases npm/pnpm/yarn, runs the lifecycle script under a profile that blocks reads outside the project dir and blocks outbound DNS during postinstall. Sell it as 'an oven mitt for npm install' to indie devs who already lost a night to this attack class.

landscape (4 existing solutions)

The market has CI-side scanners and OS-level sandboxes, but nothing in between. The gap is a dev-laptop wrapper that intercepts the package manager, runs lifecycle scripts in a syscall-restricted sandbox with no access to secrets dirs, and surfaces a notification when something tries to break out.

Socket Great for CI gating and PR comments, but does not block install-time exfil on a developer laptop. By the time Socket flags a package in a PR, the preinstall hook has already run on the dev who first added it.
Snyk CLI Vulnerability scanner, not a sandbox. It does not prevent a malicious preinstall script from reading ~/.ssh or .env.
npm --ignore-scripts Native flag but binary: either no scripts run (then half the modern toolchain breaks because legitimate native builds need scripts) or all scripts run unrestricted. There is no per-package allowlist.
Bubblewrap / firejail wrappers Generic Linux sandboxes that an experienced sysadmin can wire up, but no dev-friendly UX, no Windows or macOS story, and no integration with npm/pnpm/yarn lifecycle events.

sources (4)

other https://www.endorlabs.com/learn/shai-hulud-the-third-coming-... "The malicious payload collected CI secrets such as SSH keys or API tokens." 2026-04-24
other https://www.cremit.io/blog/bitwarden-cli-supply-chain-attack... "A 90-minute npm window stole AWS, GCP, GitHub tokens." 2026-04-23
other https://www.securitytoday.de/en/2026/04/27/bitwarden-cli-sup... "A simple npm install was enough." 2026-04-27
other https://thehackernews.com/2026/04/bitwarden-cli-compromised-... "A novel module that specifically targets authenticated AI coding assistants." 2026-04-23
supply-chainnpmsecurityindie-devsecrets