Supply chain attacks this week target CI build environments and stolen developer keys

OX Security reported that attackers likely used a stolen developer access key to push malicious code into the official bee-js and swarm-desktop repositories, which triggered automated npm and GitHub releases. The malicious package carried a dropper that uploaded a local Swarm node's encrypted key and config before installing a backdoor. A separate campaign from a newly created GitHub account used pull requests to try to exfiltrate CI environment variables and signing material, and even instructed reviewers to ignore it. The author argues that build jobs often hold registry, cloud and deploy credentials alongside untrusted install scripts, making them prime targets. The recommended defense is to separate dependency installation from deployment so that no single job holds most of the secrets.