The Bitwarden CLI NPM package compromise is tied to a Checkmarx supply chain attack and references the Shai-Hulud worm.
Up to four npm packages on Axios were replaced with malicious versions, in one of the most sophisticated supply chain attacks.