GitGuardian Views on helloworm00

GitGuardian's analysis of the @bitwarden/cli npm package compromise reveals a sophisticated supply chain attack. The malware uses GitHub as a C2 channel, staging stolen PATs in public commit messages tagged with 'LongLiveTheResistanceAgainstMachines' and discovering exfiltration domains via 'beautifulcastle' commits. A new Cloudflare exfiltration domain was identified: safely-irc-weblogs-few[.]trycloudflare[.]com. One confirmed victim was compromised via the Checkmarx KICS Docker image, which was pulled automatically by Dependabot during a CI dependency update — giving the malware access to repository secrets. GitGuardian links this to the broader TeamPCP campaign and recommends applying cooldown periods to automated dependency updates.