Benign javascript Download

@bitwarden/cli 2026.4.0

Legitimate Bitwarden CLI package

Detached self re-exec behavior__DAEMONIZED environment flag
SHA-25699ac962005550130398d55af2527d839e73489bc7911e7c2c37474d979aaf43f
URLhttps://registry.npmjs.org/@bitwarden/cli/-/cli-2026.4.0.tgz
MaleculeK₂(Li₅Te)O₈(As₄CCa₂DyEuISXe)H₇(Po₁₀Cm₃₅Cr₅Db₂₂F₈Os₁₀U)Md₆(BkInPa₆)

Also flagged by https://www.stepsecurity.io/blog/rss.xml (Dev Machine Guard Now Inventories Where Developer Credentials Live ), osv (MAL-2026-3020: Malicious code in @bitwarden/cli (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.