Compromised Bee JS release targets Swarm wallets and devices

StepSecurity reports that @ethersphere/bee-js version 13.3.0, released to npm on 9 November 2026, is compromised. The malicious release runs attacker-controlled JavaScript during installation, with payloads targeting Swarm Desktop wallet data and attempting to establish persistent access on Linux, macOS, and Windows. The incident was investigated through the StepSecurity OSS Security Feed and GitHub issue #1294, with the malicious package subsequently reported to npm.

The package had 3,560 downloads across all versions in the period 1–7 November 2026, a figure predating the malicious release and not representing downloads of 13.3.0 specifically. The advisory warns users not to install 13.3.0 and notes that if lifecycle scripts were enabled during installation, a system should be treated as potentially compromised, since removing the package may not remove persistence.

The exploit chain involved changing package.json to relocate the generate-version script into postinstall and add a scripts directory, enabling the malicious code to run during consumer installations. The installation hook contacts api.frameworkmetrics[.]xyz (with the X-Ethersphere header and a platform-specific User-Agent) to retrieve a platform-tailored JavaScript payload, which is then executed with access to Node.js require and process.

Targeted Swarm Desktop wallet files are config.yaml and data-dir/keys/swarm[.]key; if present, the payload exfiltrates them as configYaml and v3 to /v1/swarm/report. Linux, macOS, and Windows payloads include persistence mechanisms via domain-specific executables and launchers, described in detail in the report. The affected package is confirmed as @ethersphere/bee-js@13.3.0; 13.2.0 reportedly remains free of the malicious installation path.

The investigation notes possible misuse of the bee-worker release identity, potentially via stolen credentials, but stops short of identifying the exact credential involved.