@ethersphere/bee-js 13.3.0: malicious npm release steals Swarm wallet files and plants persistence
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
On 2026-11-09 at 00:09:50 UTC a malicious 13.3.0 of @ethersphere/bee-js, the ethersphere JavaScript client for Ethereum Swarm, was published to npm. StepSecurity traces it to an unsigned commit pushed the previous day at 23:59:54 UTC under the bee-worker release identity, which moved a version script from prepare to postinstall; the published package still carried valid SLSA provenance because the legitimate release workflow built that source. At install time the hook requests a platform-specific JavaScript payload from api.frameworkmetrics[.]xyz and runs it through the Function constructor. The Linux and macOS payloads look for config.yaml and data-dir/keys/swarm.key in the Swarm Desktop data directory and install a user service or LaunchAgent disguised as Solidity tooling; the Windows path stages an MSI in a hidden %LOCALAPPDATA% directory and adds a Microsoft Defender exclusion for it. GitHub lists GHSA-hh7j-5m3j-23pf as critical with no fixed version. At research time the npm registry no longer lists 13.3.0 and its latest tag points at 13.2.0, whose registry metadata has no install hook; the writeup does not say whether npm removed the version. Anyone who installed 13.3.0 with lifecycle scripts enabled should treat the machine as fully compromised and rotate wallet and other secrets from a clean system. @ethersphere/swarm-cli 3.7.0 and @ethersphere/bee-dashboard 0.37.1 depend on ranges that would have resolved to 13.3.0 on a fresh install while it was latest; no source says they contain injected code.
What to do
- Do not install @ethersphere/bee-js 13.3.0; pin to 13.2.0 or a safe version and audit dependency ranges that could resolve to 13.3.0
- If 13.3.0 was installed with lifecycle scripts enabled, treat the host as fully compromised: rotate all secrets and keys from a clean machine
- Check for and remove persistence: ~/.solidity/ payloads and .run.py or .run.cjs launchers; ~/.config/systemd/user/solidity-langsupport-runner.service (Linux); ~/Library/LaunchAgents/com.solidity.langsupport.runner.plist (macOS); ScreenConnect-named installs, hidden %LOCALAPPDATA% directories named with a GUID, and Defender exclusions (Windows)
- Hash-check any ~/.solidity/linux_amd64 or linux_arm64 file against SHA-256 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 and b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 (values published by StepSecurity)
- Check Swarm Desktop data directory for accessed config.yaml and data-dir/keys/swarm.key; assume wallet keys compromised and move funds/rotate wallet credentials
- Block api.frameworkmetrics[.]xyz at network egress and hunt for connections to it, including the paths /v1/analytics, /v1/assets/ and /v1/swarm/report
- Check lockfiles and dependency trees for @ethersphere/swarm-cli 3.7.0 (depends on ^13.2.0) and @ethersphere/bee-dashboard 0.37.1 (depends on ^13.0.0), which would have resolved to 13.3.0 on a fresh install while it was latest
- Reinstall affected systems from trusted images rather than only uninstalling the package
Sources
All live incidents on Threat Watch
