Two Types of npm Supply Chain Attack: What Catches Each

Bitwarden’s @bitwarden/cli was tainted after attackers compromised a GitHub Actions workflow in the build pipeline.

The incident shows npm supply-chain attacks are not limited to stolen maintainer credentials; build systems can be poisoned too.

This differs from the 2021 ua-parser-js case, where attackers phished a maintainer’s npm account to publish malicious code.

The article argues for provenance checks to detect tampering in CI/CD and verify how packages were built.