

I’ve never heard of anything working that way. The preferred algorithm is RFC 8305 “Happy Eyeballs,” which uses whichever network responds first. Even if your clients prefer IPv4, having IPv6 available allows you to access some resources that are not available over IPv4.

This problem has nothing to do with NPM. Checkmarx was compromised last month, and during that compromise there were malicious VS Code extensions published to Visual Studio Code Marketplace. A Bitwarden developer says that somebody ran one of those malicious extensions, and GitHub API keys were stolen which were used in publishing the malicious CLI package.
It’s probably better that it happened on NPM. If the CLI were only downloadable from the Bitwarden website, it would have likely taken longer for somebody to notice something was wrong.