The Bitwarden security team identified and contained a malicious package that was briefly distributed through the npm delivery path for @bitwarden/cli@2026.4.0 between 5:57 PM and 7:30 PM (ET) on April 22, 2026, in connection with a broader Checkmarx supply chain incident. The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious ...
Unfortunately I have to use node for home project (Jellyfin tizen)
I was wondering: would it be possible to run node in a sandbox to lower the scope of the attack? (i.e. not compromise my home computer)
Or is maybe a full VM a better solution?
Don’t. Use. Npm.
That applies to pip and crate and all the other shitty lang package managers that totally fail at security
What should be used instead?
Easy, just vendor all your dependencies! Can’t have a supply chain attack if you are the supply chain.
Unfortunately I have to use node for home project (Jellyfin tizen)
I was wondering: would it be possible to run node in a sandbox to lower the scope of the attack? (i.e. not compromise my home computer) Or is maybe a full VM a better solution?