Compromised npm package @ethersphere/bee-js 13.3.0 (Swarm) steals Swarm Desktop wallet keys and installs a backdoor on Linux, macOS and Windows at install time (StepSecurity)

@ethersphere/bee-js 13.3.0, the JavaScript client for the Ethereum Swarm network, was published to npm on 9 Nov 2026 at 00:09:50 UTC with a malicious postinstall hook. Attackers misused the project's bee-worker release identity (likely a stolen credential or token, not confirmed) to push an unsigned commit (de2f74e7) and a v13.3.0 GitHub release. That release triggered the real GitHub Actions trusted-publishing workflow, so the package carries valid SLSA provenance. On npm install, scripts/generate-version.cjs fetches and runs platform-specific JavaScript from api.frameworkmetrics[.]xyz. You don't need to import the library for this to happen. The payload steals the Swarm Desktop config.yaml and data-dir/keys/swarm.key (an Ethereum V3 keystore plus its possible password). It then installs persistence. On Linux and macOS it drops a Go remote-access binary in ~/.solidity/, run by a systemd user service or a LaunchAgent. On Windows it adds a Defender exclusion and silently installs an MSI (possibly ScreenConnect). At 00:31 UTC npm still had 13.3.0 tagged as latest. Projects with ranges that allow 13.3.0 can pull it in through dependencies: @ethersphere/swarm-cli (^13.2.0), @ethersphere/bee-dashboard (^13.0.0) and the swarm-desktop repo (^13.0.0). It is unknown how many systems installed it and whether funds were stolen. 13.2.0 is clean.