@ethersphere/bee-js 13.3.0 Compromise Targets Wallet Data and Installs Persistent Access
Summary
StepSecurity found that @ethersphere/bee-js 13.3.0 runs attacker-controlled code at install, targeting Swarm Desktop wallet files and installing persistence. The report does not establish how many systems were affected or whether funds were stolen.
Key points
- The malicious 13.3.0 release was published to npm on November 9, 2026; the examined 13.2.0 release lacked the malicious installation path.
- An installation hook requests platform-specific JavaScript from api.frameworkmetrics[.]xyz and executes it with the installing user's permissions.
- If Swarm Desktop wallet files are present, the payload reads the configuration and encrypted keystore and sends them to the same host; wallet exposure and stolen funds were not established.
- The Linux and macOS scripts create persistent launchers. Windows code stages an MSI and adds a Defender exclusion, but the MSI and helper were not retrieved, so their capabilities remain unverified.
- The malicious code appeared in an unsigned direct commit under the bee-worker identity; the report says misuse of that identity is indicated, but the credential and access method are unknown.
- StepSecurity advises checking dependency resolution and installation logs, investigating persistence and indicators, and treating systems as compromised if the payload ran.
Article Details
- Attack Vectors
- A malicious direct commit under the bee-worker identity was included in @ethersphere/bee-js 13.3.0 and published through the repository's existing npm workflow.
- The package's postinstall hook retrieves platform-specific JavaScript from api.frameworkmetrics[.]xyz and executes it with the installing user's permissions.
- The payload searches for Swarm Desktop wallet files and, if present, sends their contents to the same host.
- Platform-specific payloads install persistence on Linux and macOS; the Windows script stages PowerShell and VBScript launchers and attempts to run an MSI whose identity was not confirmed.
- Defensive Notes
- Do not install @ethersphere/bee-js 13.3.0. Check direct and transitive dependencies, lockfiles, installed metadata, and CI logs; the examined 13.2.0 release lacks the malicious installation path.
- Review DNS, proxy, and endpoint records for the listed infrastructure and persistence locations. A successful installation log does not rule out execution because the hook suppresses network errors.
- If the payload may have run, isolate the host, preserve evidence, investigate persistence, and rebuild from a trusted image. Removing or replacing the package alone does not remove installed persistence.
- Rotate credentials accessible to the affected user or CI job from a clean environment. If Swarm Desktop wallet files were present, treat the keystore and any password in config.yaml as exposed and replace the wallet from a clean system.
- Blocking lifecycle scripts prevents this particular installation hook from running, but does not remediate prior execution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]frameworkmetrics[.]xyz | Attacker-controlled host used to deliver platform-specific payloads and receive exfiltrated Swarm Desktop wallet data. |
| SHA1 | a205c8a5fed81e9a787645b2801f00be3db3348d | SHA-1 hash of the malicious npm package tarball. |
| SHA256 | 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 | SHA-256 hash of the retrieved Linux x86-64 executable associated with the compromise. |
| SHA256 | b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 | SHA-256 hash of the retrieved Linux ARM64 executable associated with the compromise. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload reads config.yaml and swarm.key from the Swarm Desktop data directory when both files are present.T1041 · Exfiltration Over C2 ChannelThe payload sends the collected Swarm Desktop wallet files to /v1/swarm/report on the same attacker-controlled host.T1059.001 · PowerShellThe Windows script stages PowerShell launchers and attempts to retrieve invoke.ps1; the article does not confirm that the unretrieved script ran.T1059.007 · JavaScriptThe installation hook executes downloaded platform-specific JavaScript using the Function constructor with access to Node.js require and process.T1105 · Ingress Tool TransferThe hook and platform payloads download JavaScript and executables from the attacker-controlled host.T1195.002 · Compromise Software Supply ChainA malicious commit was included in @ethersphere/bee-js 13.3.0 and published to npm through the repository's release workflow.T1543.001 · Launch AgentThe macOS payload writes a LaunchAgent plist with RunAtLoad enabled and attempts to start it through launchctl.T1543.002 · Systemd ServiceThe Linux payload configures the user service solidity-langsupport-runner.service to provide persistence.T1562.001 · Disable or Modify ToolsThe Windows script adds a Microsoft Defender exclusion for the hidden directory used to stage the MSI.
Products
@ethersphere/bee-jsStepSecurity AI Package Analyst discovered that @ethersphere/bee-js version 13.3.0 is compromised. Published to npm on November 9, 2026, at 00:09:50 UTC, the release downloads and executes attacker-controlled JavaScriptMicrosoft Defender Antimalware PlatformIts installation sequence creates a hidden directory under %LOCALAPPDATA%, adds a Microsoft Defender exclusion for that directory, and runs the MSI silently. Cleanup code removes the exclusion and staging filesSwarm Desktopand executes attacker-controlled JavaScript during installation. The retrieved payloads target Swarm Desktop wallet files and attempt to install persistent access on Linux, macOS, and Windows.