A post by @SlowMist_Team on X.

Attackers abused compromised GitHub accounts and legitimate release pipelines to push the tainted builds, meaning the compromise originated in trusted distribution channels rather than the code itself. The affected package is the JavaScript client for Bee, the node software for the Swarm decentralized storage network, so any application or tooling that pulled the latest version may have ingested the malicious release. The incident matters because it extends a run of supply chain compromises in crypto developer tooling, where a single poisoned dependency can propagate across many downstream projects. What to watch next: whether Ethersphere publishes a patched release and a post-mortem, and whether projects that depend on bee-js pin to a known-good version or reinstall to purge the compromised build.