The hidden VS Code tool has replaced the terminal for me.
The Bitwarden CLI NPM package compromise is tied to a Checkmarx supply chain attack and references the Shai-Hulud worm.