Tag: bee-js

Tracing the @ethersphere/bee-js 13.3.0 Compromise Into Downstream Builds

Step Security's report on the compromised @ethersphere/bee-js 13.3.0 release traces how a malicious npm publish can reach downstream builds and which provenance, lockfile, pinning, and maintainer-hardening controls limit the blast radius.