All Detections

TeamPCP - Bitwarden CLI NPM Hijack (T1195.002)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026403

Identifies developers or CI pipelines executing the hijacked @bitwarden/cli npm package (v2026.4.0) during the exposure window.

Microsoft Sentinel (KQL)