Bitwarden's NPM Package was Compromised

Hello Friends

For your consideration, bitwarden is compromised, for more details watch:

Best to all

2 Likes

That is serious … of all things, a password manager shoukd never be compromised.
Can you imagine, millions of users having to change passwords.
The dangers of cèntralising are apparent.

3 Likes

Wow, I use Bitwarden. A bit scary.
https://www.forbes.com/sites/daveywinder/2026/04/24/bitwarden-confirms-compromise-here-are-the-facts-for-10-million-users/

"A Bitwarden spokesperson said: “The investigation found no evidence that end-user vault data was accessed or at risk, or that production data or production systems were compromised. "

5 Likes

I remember a few years back LastPass suffered a massive data breach…

The least impact solutions to these sorts of issues are to SELF HOST!

3 Likes

That is a noncommittal statement. It means ‘we dont know’

4 Likes

Having said that - I will admit - I let my Browser (mostly Brave) remember most of my passwords for important shyte… But many things I don’t…

Like work stuff…

I use KeepassCLI (uses Keepass V1 database - same file format as KeepassXC) for work passwords - and on top of that - they all have MFA - one of them has two layers of MFA on two different android apps…

4 Likes

Could you give a little more info on self hosting?

3 Likes

Yeah - you keep a password database (securely) on your own equipment…

I share my main PW database (a Keepass 1.0 format kdb file) with my cloud solution (also self hosted)… My cloud solution (Self hosted) is ResilioSync - that folder structure gets shared across multiple computers - mostly my two Macs and my Linux desktop machine.

I can run keepassCLI on Mac or Linux - and unlock my keepass database… I could also run KeepassXC if need be…

I have a ZSH alias :

╭─x@methone.local ~
╰─➤  grep -i pzwd .zshrc
alias pzwd="kpcli --kdb=${HOME}/ResilioSync/xr3t/KeepAss/commons/commons.kdbx"

“xp 0” copies the password in the 0. entry to the clipboard - works just as well on Mac in terminal (Mac Terminal or iTerm2) and Linux…


I’ll add one further thing - it’s a LOT easier to organise the password database structure in a GUI password manager like KeepassXC… I setup this database in KeepassXC - but I use keepasscli to extract passwords from it… I sometimes edit the entries in keepasscli - but it’s a lot easier in KeepassXC…

4 Likes