A malicious bee-js release hit npm with valid provenance and no npm token. The attackers used Ethersphere's own release bot.
With trusted publishing, the workflow is the credential. It should refuse any commit that isn't on a protected branch.
socket.dev/blog/bee-js-co…
nvm v0.41.0 is out!
New: --only=alpha,lts,non-lts,iojs to pick versions by category (alphas hidden by default), --lts aliases, annotated ls-remote.
Plus 59 bug fixes and 7 security fixes, 25 of which were found and fixed with help from @AnthropicAI's OSS Scanner.
nvm v0.41.0 is out!
New: --only=alpha,lts,non-lts,iojs to pick versions by category (alphas hidden by default), --lts aliases, annotated ls-remote.
Plus 59 bug fixes and 7 security fixes, 25 of which were found and fixed with help from @AnthropicAI's OSS Scanner.