Between 21:57 and 23:30 UTC on April 22, 2026, a malicious @bitwarden/[email protected] was live on npm for 93 minutes — long enough to reach CI/CD pipelines, developer workstations, and cloud automation hosts. The payload steals credentials across GitHub, AWS, GCP, and Azure, propagates as a self-replicating npm worm, injects GitHub Actions workflow stealers, and poisons AI codin...
follow.it gives you an easy way to subscribe to Phoenix Security's news feed! Click on Follow below and we deliver the updates you want via email, phone or you can read them here on the website on your own news page.
You can also unsubscribe anytime painlessly. You can even combine feeds from Phoenix Security with other site's feeds!
Title: Phoenix Security - FIX Vulnerability with context from appsec to cloud security