If You Installed @ethersphere/bee-js 13.3.0 or Ran Swarm Desktop 0.56.2, Treat That Machine as Compromised. The Attacker Published Both Through the Project's Own Release Automation
Search your lockfiles, CI logs and package caches for @ethersphere/bee-js version 13.3.0. If you find it, treat the machine or CI runner that installed it as compromised, and rotate every secret it could read from a different, clean computer. If you run Swarm Desktop, open its log file and look for the line "Bee Desktop version: 0.56.2 (production)". If that line is there, install 0.56.3 and assume your node key and password were stolen.
What has been reported
Everything below comes from The Hacker News report of November 9, 2026, the GitHub advisory GHSA-hh7j-5m3j-23pf, and the Swarm Desktop maintainer's incident note as quoted by The Hacker News.
bee-js 13.3.0 was live on npm from 00:09 to 01:25 UTC, then removed. Version 13.2.0 is the latest again. The GitHub advisory lists the affected version as exactly 13.3.0 and patched versions as "None". Its text: "Any computer that has this package installed or running should be considered fully compromised."
Swarm Desktop 0.56.2 appeared on GitHub around 00:36 UTC and was withdrawn about 8.5 hours later. Its built-in updater could offer it to Windows x64 and Apple Silicon Macs. Intel Macs were not offered it, and Linux installs do not auto-update. Version 0.56.3 contains the same code as 0.56.1 under a new Developer ID certificate. The maintainer wrote that 0.56.2 "was published by an attacker using stolen CI credentials and has been withdrawn."
Downstream packages swarm-cli, bee-dashboard and the Swarm Desktop source accepted version ranges that included 13.3.0, so a transitive install is possible.
Reach, as estimated in the report: about 10 downloads of bee-js 13.3.0, including scanners and mirrors, and 65 of Swarm Desktop 0.56.2 as of 08:27 UTC. These are small numbers. They are download counts, not confirmed victims.
What the code does
According to the report: a short loader pulls more code from api.frameworkmetrics[.]xyz and runs it with the user's permissions. In bee-js it runs as an npm postinstall script. In Swarm Desktop it runs every time the app starts.
The payload looks for config.yaml and data-dir/keys/swarm.key in Swarm Desktop's data folder and sends them out. The key file is an encrypted keystore, but the password is stored in plain text in config.yaml, so both together give an attacker the node wallet, chequebook funds and stake.
It also installs a persistent backdoor. On Linux and macOS this is a Go remote shell called evjawbreaker, kept in a hidden ~/.solidity folder and started as a systemd user service or LaunchAgent. Its control server address is read from an Ethereum contract, so the operator can move it without touching the host. On Windows it installs a genuine, ConnectWise-signed ScreenConnect client as a system service, adds a Microsoft Defender exclusion, and uses a known UAC bypass if the user is an administrator.
Updating, reinstalling or uninstalling does not remove these pieces. That is why the advisory says removing the package is not enough.
How the attacker got a valid-looking release
Both releases came from the project's bee-worker automation account, with no pull request and no signature on the change. A GitHub release triggered the npm publish workflow, which needed no approval and finished in 73 seconds. The package carried valid npm provenance because the real workflow built it. Provenance tells you where a package was built, not whether anyone reviewed the code that went in. The Swarm Desktop build was started by hand using the project's Apple and Windows signing certificates, so the macOS app was notarized and showed only the normal first-launch prompt.
How the attacker got in is not settled. The maintainer's note blames stolen CI credentials. The report's analysis indicates two GitHub accounts were used: bee-worker and a long-time maintainer's. The project now requires DevOps approval for signing jobs and runs them only from the main branch.
Pluto Security links the payloads to the group behind the 2025 SleepyDuck malware "with high confidence," and Socket also attributes these releases to that group. We have not examined the samples ourselves, so that attribution is theirs.
What to do
Search lockfiles, caches, internal registries, mirrors and CI logs for @ethersphere/[email protected], including transitive copies. Pin to 13.2.0 and clear cached copies of 13.3.0.
If 13.3.0 was installed with install scripts enabled, treat that machine as compromised. From a clean machine, rotate every password, token and key the installing user or CI job could read. Rebuild from a trusted image where you can.
For Swarm Desktop, check bee-desktop.log. It is under ~/Library/Logs/Swarm Desktop/ on macOS, %LOCALAPPDATA%\Swarm Desktop\Log\ on Windows and ~/.local/state/Swarm Desktop/ on Linux. The version line is written at launch, before the malicious code runs.
If 0.56.2 ran, treat the node key and password as stolen. From a clean machine, move funds, chequebook and stake to a new key. Then install 0.56.3. On Linux, replace the package by hand.
Look for the leftovers: the ~/.solidity folder, the solidity-langsupport-runner.service unit on Linux, the com.solidity.langsupport.runner LaunchAgent on macOS, and a ScreenConnect Client service with the ID 5cbe79c9c25524df on Windows.
Block and search logs for api.frameworkmetrics[.]xyz, the paths /v1/analytics, /v1/electron, /v1/assets/ and /v1/swarm/report, and the request header X-Ethersphere: 1. The report also lists 193[.]57[.]9[.]155 port 4912 (the backdoor control server) and 185[.]232[.]84[.]169 port 8041 (the ScreenConnect relay).
For your own repositories: a publish workflow that runs on a bare GitHub release with no approval step is the door used here. Require a reviewer on the environment that holds the npm token, and treat a signing certificate in CI as a credential an attacker can use.
What is not known
How the CI credentials were stolen. Whether anyone lost funds: the report gives download counts, not losses. Whether other Ethersphere packages were touched. The report lists SHA-256 hashes for the Go backdoor binaries (Linux and macOS, both architectures), a PowerShell script and an MSI; we have not verified them.
How we know, and how we checked
We read The Hacker News report and the GitHub advisory page directly. The advisory confirms the package, the single affected version, the absence of a patched version and the quoted wording. It does not state a severity. The behavior, timestamps, download counts, indicators and attribution come from The Hacker News, which cites Socket, SafeDep, Pluto Security and the Swarm Desktop maintainer's pull request note; we did not open those directly. Where a number is a download count we say so. We add no indicators to our feed from this post: the report's indicators are from a secondary source and we have not confirmed them against the original analyses.
Sources
The Hacker News, "Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware," November 9, 2026. GitHub advisory GHSA-hh7j-5m3j-23pf. As cited there and not opened by us: Socket, "bee-js compromise"; SafeDep, "Ethersphere bee-js npm compromise"; Swarm Desktop pull request 582 and release v0.56.3; Pluto Security on SleepyDuck.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. The question lives here: https://analytics.dugganusa.com/nps.html#post=ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-compromised
Comments