Tracing the @ethersphere/bee-js 13.3.0 Compromise Into Downstream Builds
Step Security published a write-up titled "@ethersphere/bee-js 13.3.0 Compromised", and the feed entry carrying it is dated 9 November 2026. That is roughly the whole confirmed record: the post does not state a payload, an intrusion vector, a last known-good version, or the current registry state of 13.3.0. So this short works from npm mechanics instead of incident specifics. It separates the repository you review from the tarball your build installs, then walks the trace: enumerate the resolved tree with npm ls so a deduped copy can't hide behind a wrapper package, grep the lockfiles directly for workspaces a resolver skipped, diff a packed 13.3.0 tarball against a prior release, and read the lockfile entry as evidence — the integrity digest pins the exact bytes, resolved names the host that served them, and the install-script flag records whether the package declares install scripts. It also covers why a caret range is a standing authorisation to accept future publishes, and why the absence of a provenance attestation means a signature check had nothing to verify. Everything beyond the confirmed facts is labelled as inference in the post, and the terminal output shown is from a synthetic project, not the real package. Full write-up: https://hackyjs.com/posts/tracing-the-etherspherebee-js-1330-compromise-into-downstream-builds