Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden

Checkmarx said data may have been taken from its GitHub repositories after access tied to a March 23, 2023 supply-chain attack.

Socket said Bitwarden was also affected when a malicious npm package briefly moved through its CLI delivery path.

The activity reused infrastructure linked to the Trivy campaign, showing how one vendor breach can cascade into others.

The case highlights the risk of trusted software distribution channels being abused for credential theft and downstream compromise.