{"id":"CMP-202611-u63dfy","kind":"campaign","aliases":[],"related":[],"title":"Compromised npm package @ethersphere/bee-js 13.3.0 (Swarm) steals Swarm Desktop wallet keys and installs a backdoor on Linux, macOS and Windows at install time (StepSecurity)","description":null,"summary":"@ethersphere/bee-js 13.3.0, the JavaScript client for the Ethereum Swarm network, was published to npm on 9 Nov 2026 at 00:09:50 UTC with a malicious postinstall hook. Attackers misused the project's bee-worker release identity (likely a stolen credential or token, not confirmed) to push an unsigned commit (de2f74e7) and a v13.3.0 GitHub release. That release triggered the real GitHub Actions trusted-publishing workflow, so the package carries valid SLSA provenance. On npm install, scripts/generate-version.cjs fetches and runs platform-specific JavaScript from api.frameworkmetrics[.]xyz. You don't need to import the library for this to happen. The payload steals the Swarm Desktop config.yaml and data-dir/keys/swarm.key (an Ethereum V3 keystore plus its possible password). It then installs persistence. On Linux and macOS it drops a Go remote-access binary in ~/.solidity/, run by a systemd user service or a LaunchAgent. On Windows it adds a Defender exclusion and silently installs an MSI (possibly ScreenConnect). At 00:31 UTC npm still had 13.3.0 tagged as latest. Projects with ranges that allow 13.3.0 can pull it in through dependencies: @ethersphere/swarm-cli (^13.2.0), @ethersphere/bee-dashboard (^13.0.0) and the swarm-desktop repo (^13.0.0). It is unknown how many systems installed it and whether funds were stolen. 13.2.0 is clean.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T01:45:07+00:00","products":[{"name":"@ethersphere/bee-js","fixed":["13.2.0"],"affected":"= 13.3.0","ecosystem":"npm"},{"name":"@ethersphere/swarm-cli","fixed":[],"affected":"3.7.0 (via ^13.2.0 dependency range)","ecosystem":"npm"},{"name":"@ethersphere/bee-dashboard","fixed":[],"affected":"0.37.1 (via ^13.0.0 dependency range)","ecosystem":"npm"},{"name":"Swarm Desktop","fixed":[],"affected":"builds resolving bee-js 13.3.0"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look in lockfiles, node_modules and CI install logs for @ethersphere/bee-js@13.3.0, including as a dependency of @ethersphere/swarm-cli, @ethersphere/bee-dashboard or swarm-desktop (npm tarball SHA-1 a205c8a5fed81e9a787645b2801f00be3db3348d). A clean install log does not prove you are safe, because the hook hides network errors. Check DNS and proxy logs for api.frameworkmetrics[.]xyz (paths /v1/analytics, /v1/assets/, /v1/swarm/report; header X-Ethersphere: 1 with User-Agent linux, darwin or win32). Linux: ~/.solidity/linux_amd64 or linux_arm64, ~/.solidity/.run.py, ~/.config/systemd/user/solidity-langsupport-runner.service. SHA-256 of linux_amd64: 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696; linux_arm64: b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565. macOS: ~/.solidity/darwin_arm64 or darwin_amd64, .run.cjs or .run.py, ~/Library/LaunchAgents/com.solidity.langsupport.runner.plist. Windows: %TEMP% files starting with .stuffed-, %LOCALAPPDATA%\\.<32-hex-guid>\\app.msi, a new Defender exclusion for a hidden %LOCALAPPDATA% folder.","fix":"Don't install 13.3.0. Pin @ethersphere/bee-js to 13.2.0 (or another reviewed release) and refresh lockfiles. Install with --ignore-scripts until the maintainers confirm a clean release. If 13.3.0 was installed with scripts enabled, isolate the machine or CI runner and treat it as compromised. Removing the package does not remove the systemd service, LaunchAgent or MSI, so rebuild from a trusted image. From a clean machine, rotate every credential the installing user or CI job could reach. If Swarm Desktop wallet files were present, treat the keystore and the password in config.yaml as stolen and move the funds to a new wallet created on a clean system.","status":"open","published_at":"2026-11-09T00:00:00+00:00","first_seen_at":"2026-11-09T01:45:07+00:00","triaged_at":"2026-11-09T01:45:07+00:00","updated_at":"2026-11-09T01:45:58+00:00","category":"package","confidence":null,"triage":{"cause":{"at":"2026-11-09T01:45:23Z","path":"tampered-install","entry":"stolen-credential","reason":"The record says attackers misused the project's bee-worker release identity, which was likely a stolen credential or token though not confirmed, and dependents installed the npm package 13.3.0 carrying a malicious postinstall hook.","confidence":0.55}},"analyst_status":"done","analyst_note":null,"search":"'-202611':26A '/.solidity':175B '/keys/swarm.key':149B '00':56B,200B '09':57B '13.0.0':225B,232B '13.2.0':223B,246B '13.3.0':5A,38B,206B,215B '2026':54B '31':201B '50':58B '9':52B 'access':172B 'action':100B 'add':188B 'allow':214B 'api.frameworkmetrics':124B 'attack':65B 'backdoor':15A 'bee':71B 'bee-work':70B 'binari':173B 'campaign':33B 'carri':108B 'clean':248B 'client':41B 'cmp':25A 'commit':87B 'compromis':1A 'config.yaml':144B 'confirm':82B 'credenti':78B 'data':147B 'data-dir':146B 'de2f74e7':88B 'defend':190B 'depend':221B 'desktop':9A,32A,143B,230B 'dir':148B 'drop':167B 'earli':35B 'early-warn':34B 'ethereum':44B,151B 'ethersphere/bee-dashboard':30A,224B 'ethersphere/bee-js':4A,28A,37B 'ethersphere/swarm-cli':29A,222B 'exclus':191B 'fetch':116B 'fund':243B 'github':92B,99B 'go':169B 'happen':137B 'hook':64B 'ident':74B 'import':131B 'instal':13A,22A,114B,160B,194B,239B 'javascript':40B,122B 'key':11A 'keystor':153B 'latest':209B 'launchag':184B 'librari':133B 'like':75B 'linux':17A,163B 'maco':18A,165B 'malici':62B 'mani':237B 'misus':66B 'msi':196B 'need':129B 'network':46B 'nov':53B 'npm':2A,50B,113B,203B 'packag':3A,107B 'password':157B 'payload':139B 'persist':161B 'platform':120B 'platform-specif':119B 'plus':154B 'possibl':156B,197B 'postinstal':63B 'project':68B,210B 'proven':111B 'publish':48B,103B 'pull':217B 'push':84B 'rang':212B 'real':98B 'releas':73B,93B,95B 'remot':171B 'remote-access':170B 'repo':231B 'run':118B,176B 'screenconnect':198B 'scripts/generate-version.cjs':115B 'servic':181B 'silent':193B 'slsa':110B 'specif':121B 'steal':7A,140B 'stepsecur':24A 'still':204B 'stolen':77B,245B 'swarm':6A,8A,31A,45B,142B,229B 'swarm-desktop':228B 'system':238B 'systemd':179B 'tag':207B 'time':23A 'token':80B 'trigger':96B 'trust':102B 'trusted-publish':101B 'u63dfy':27A 'unknown':235B 'unsign':86B 'user':180B 'utc':59B,202B 'v13.3.0':91B 'v3':152B 'valid':109B 'wallet':10A 'warn':36B 'whether':242B 'window':20A,186B 'worker':72B 'workflow':104B 'xyz':125B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["beedashboard","beejs","desktop","swarmcli","swarmdesktop"],"ptokens":["bee","cli","dashboard","desktop","ethersphere","js","swarm"],"labels":["campaign","critical","earlywarning","package"],"campaign_type":"supply-chain","search_a":"'-202611':26A '13.3.0':5A 'backdoor':15A 'cmp':25A 'compromis':1A 'desktop':9A,32A 'ethersphere/bee-dashboard':30A 'ethersphere/bee-js':4A,28A 'ethersphere/swarm-cli':29A 'instal':13A,22A 'key':11A 'linux':17A 'maco':18A 'npm':2A 'packag':3A 'steal':7A 'stepsecur':24A 'swarm':6A,8A,31A 'time':23A 'u63dfy':27A 'wallet':10A 'window':20A","search_b":"'/.solidity':175B '/keys/swarm.key':149B '00':56B,200B '09':57B '13.0.0':225B,232B '13.2.0':223B,246B '13.3.0':38B,206B,215B '2026':54B '31':201B '50':58B '9':52B 'access':172B 'action':100B 'add':188B 'allow':214B 'api.frameworkmetrics':124B 'attack':65B 'bee':71B 'bee-work':70B 'binari':173B 'campaign':33B 'carri':108B 'clean':248B 'client':41B 'commit':87B 'config.yaml':144B 'confirm':82B 'credenti':78B 'data':147B 'data-dir':146B 'de2f74e7':88B 'defend':190B 'depend':221B 'desktop':143B,230B 'dir':148B 'drop':167B 'earli':35B 'early-warn':34B 'ethereum':44B,151B 'ethersphere/bee-dashboard':224B 'ethersphere/bee-js':37B 'ethersphere/swarm-cli':222B 'exclus':191B 'fetch':116B 'fund':243B 'github':92B,99B 'go':169B 'happen':137B 'hook':64B 'ident':74B 'import':131B 'instal':114B,160B,194B,239B 'javascript':40B,122B 'keystor':153B 'latest':209B 'launchag':184B 'librari':133B 'like':75B 'linux':163B 'maco':165B 'malici':62B 'mani':237B 'misus':66B 'msi':196B 'need':129B 'network':46B 'nov':53B 'npm':50B,113B,203B 'packag':107B 'password':157B 'payload':139B 'persist':161B 'platform':120B 'platform-specif':119B 'plus':154B 'possibl':156B,197B 'postinstal':63B 'project':68B,210B 'proven':111B 'publish':48B,103B 'pull':217B 'push':84B 'rang':212B 'real':98B 'releas':73B,93B,95B 'remot':171B 'remote-access':170B 'repo':231B 'run':118B,176B 'screenconnect':198B 'scripts/generate-version.cjs':115B 'servic':181B 'silent':193B 'slsa':110B 'specif':121B 'steal':140B 'still':204B 'stolen':77B,245B 'swarm':45B,142B,229B 'swarm-desktop':228B 'system':238B 'systemd':179B 'tag':207B 'token':80B 'trigger':96B 'trust':102B 'trusted-publish':101B 'unknown':235B 'unsign':86B 'user':180B 'utc':59B,202B 'v13.3.0':91B 'v3':152B 'valid':109B 'warn':36B 'whether':242B 'window':186B 'worker':72B 'workflow':104B 'xyz':125B","search_c":"","cause_entry":"stolen-credential","cause_path":"tampered-install","disclosures_checked_at":"2026-11-09T01:50:27+00:00","first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-u63dfy","url":null,"severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-09T01:45:07+00:00","fetched_at":"2026-11-09T01:45:07+00:00","note":null}],"documents":[{"id":104940,"url":"https://www.stepsecurity.io/blog/ethersphere-bee-js-13-3-0-compromise","title":"StepSecurity: @ethersphere/bee-js 13.3.0 Compromised","kind":"blog","source":"blog","publisher":null,"text":"@ethersphere/bee-js 13.3.0 Compromised\n\n@ethersphere/bee-js 13.3.0 is compromised. Malicious install-time code targets Swarm wallet data and attempts to establish persistent access on affected systems.","published_at":"2026-11-09T01:18:18+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}