# Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

Source: [Socket](https://socket.dev/blog/bee-js-compromise?utm_medium=feed) · 2026-11-09 · Security
Page: https://themorning.dev/story/malicious-bee-js-npm-release-and-swarm-desktop-releases-deliver-sleepyduck-ether-43e001200d16b54a
Kind: security · Impact: high

## In brief

- @ethersphere/bee-js version 13.3.0 is reported as compromised.
- Malicious install-time code targets Swarm wallet data.
- The malware attempts to establish persistent access on affected systems.

## Why it matters

Developers who installed @ethersphere/bee-js 13.3.0 may have had Swarm wallet data exposed and may have persistent access on their systems.

## What to do

- Check whether projects or build machines have @ethersphere/bee-js 13.3.0 installed

## Versions

- @ethersphere/bee-js 13.3.0

## Timeline

- 2026-11-09: Step Security reports @ethersphere/bee-js 13.3.0 is compromised

## Coverage

- [Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor](https://socket.dev/blog/bee-js-compromise?utm_medium=feed) — Socket, 2026-11-09
- [@ethersphere/bee-js 13.3.0 Compromised](https://www.stepsecurity.io/blog/ethersphere-bee-js-13-3-0-compromise) — Step Security Blog, 2026-11-09

Tags: npm, supply-chain, malware, swarm, javascript

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev