Malicious @ethersphere/bee-js 13.3.0 npm release delivers install-time malware and SleepyDuck backdoor

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Users who installed @ethersphere/bee-js 13.3.0

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover · Supply chain

What to do

Check whether projects or build machines have @ethersphere/bee-js 13.3.0 installed

The Brief

Developers who installed @ethersphere/bee-js 13.3.0 may have had Swarm wallet data exposed and may have persistent access on their systems.

Checklist · 4 of 10 yes

Yes	Hits tech teams	Developer library: npm SDK that developers build with for Swarm applications.
No	Core infrastructure	Single niche SDK, not core infrastructure shared by nearly every team.
No	Popular tool	Swarm-specific SDK, not a widely used mainstream framework or top-1000 package.
Yes	Exploited in the wild	Step Security Blog: 13.3.0 is compromised with malicious install-time code, a real malware campaign.
No	Public exploit	Step Security Blog reports the compromise but says nothing about published exploit code.
No	Remote, no login	Step Security Blog: malicious code runs at install time; no unauthenticated network attack described.
Yes	Full takeover	Step Security Blog: install-time malicious code attempts to establish persistent access on affected systems.
No	Secrets exposed	Step Security Blog says malware targets Swarm wallet data; it does not say data was stolen.
Yes	Supply chain	Step Security Blog: the published npm package version 13.3.0 is compromised with malicious code.
No	No fix yet	Step Security Blog does not state whether a patched version exists.

First seen 17h ago · 2 sources · Full story page · How tiers are decided