607
Bitwarden CLI distributed through NPM has been compromised. Bitwarden Statement on Checkmarx Supply Chain Incident.
(community.bitwarden.com)
this post was submitted on 23 Apr 2026
607 points (99.7% liked)
Selfhosted
58738 readers
1270 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
As much as some people deride it Javascript is one of the most used languages on the planet.
This is basically the same as people thinking windows is less secure because it's more often targeted.
JavaScript does have a bit of a problem with dependencies but it isn't much different than other languages with built in package managers like rust. It's just a bigger juicer target.
But Windows is less secure. Two things can be true at once. They are in the original topic too.
The Java ecosystem is massive and decades old and I don't hear one iota of the shit about maven central that I hear about npm.
I guarantee that npm is full up with vibe coded bullshit at this point as well.
I'm not sure what it even takes to upload a package to npm. Not even a pulse. I honestly never looked into it because the whole ecosystem is so rancid.
EDIT: Look at how many shits in this are optional (and note the overall quality of the article as well): https://dev.to/aneshodza/publishing-your-first-npm-library-51k2. The ecosystem sucks.