Security · High impactFan score 47 · Tier B2 sources
Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
Socket Blog · By Socket Research Team ·
The Brief · written from 2 sources
- @ethersphere/bee-js version 13.3.0 is reported as compromised.
- Malicious install-time code targets Swarm wallet data.
- The malware attempts to establish persistent access on affected systems.
Why it matters
Developers who installed @ethersphere/bee-js 13.3.0 may have had Swarm wallet data exposed and may have persistent access on their systems.
Who’s affected
- Anyone who installed @ethersphere/bee-js 13.3.0
What to do
- Check whether projects or build machines have @ethersphere/bee-js 13.3.0 installed
- @ethersphere/bee-js 13.3.0
- #npm
- #supply-chain
- #malware
- #swarm
- #javascript
Socket’s Threat Research Team analyzed the November 9, 2026 compromise of Ethersphere’s release pipeline, in which a threat actor used the project’s own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2 release on…
Timeline
Step Security reports @ethersphere/bee-js 13.3.0 is compromised
Step Security Blog
@ethersphere/bee-js 13.3.0 Compromised
Socket
Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
Full coverage · 2 sources
- 3h ago ↗
Socket
Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
- 17h ago ↗
Step Security Blog
@ethersphere/bee-js 13.3.0 Compromised