Ethersphere bee-js npm maintainer account compromised, version 13.3.0 backdoored
On 9 November 2026 a malicious @ethersphere/bee-js 13.3.0 was published to npm via a compromised release identity. The version contains a postinstall hook that downloads and executes remote code, stealing Swarm node keys and installing a persistent remote shell.
Published 9 Nov 2026 · Updated 10 Nov 2026
Every version named by the advisory is in the scanner, so a lockfile check finds it directly.
- Severity
- Critical
- Type
- Compromise
- Published
- 9 Nov 2026
- Last updated
- 10 Nov 2026
- Ecosystems
- npm
- Detected by
- StepSecurity
- Source
- github.com
Compromise. A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
The full picture
At 00:09 UTC on 9 November 2026, @ethersphere/bee-js version 13.3.0 was published to npm via a compromised developer access key. The malicious version was live for approximately 75 minutes before npm pulled it at 01:25 UTC, but the tarball may have been cached by third-party mirrors such as Huawei Cloud.
The release carried valid SLSA provenance linked to the legitimate repository, meaning automated verification tools would have accepted it. StepSecurity identified it as malicious and attributed the attack to misuse of the bee-worker release identity rather than a registry-side vulnerability.
The payload adds a postinstall hook that downloads and executes remote JavaScript. It steals Swarm Desktop node private keys and encrypted wallet material, and installs a persistent remote-shell agent on Windows, macOS and Linux. Swarm Desktop 0.56.2, which bundled bee-js, was also backdoored; the Ethersphere team replaced it with 0.56.3 the same day.
The Ethersphere team acknowledged the incident via GitHub issue #1294. The last legitimate release is 13.2.0. Dependents such as @ethersphere/swarm-cli 3.7.0 pin ^13.2.0, which would resolve to 13.3.0 on a fresh install.
1 package 1 version
These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.
What it does if you installed it
- Credential theft: Swarm Desktop node private keys are exfiltrated
- Persistent backdoor: a remote-shell agent is installed on the host
- Downstream risk: dependents using ^13.x ranges may pull in 13.3.0 via lockfile updates; third-party npm mirrors may still serve the cached tarball
Clean-up steps
- Pin @ethersphere/bee-js to 13.2.0 and delete node_modules, then reinstall
- If 13.3.0 was installed, treat the host as fully compromised: isolate, image, and rebuild
- Rotate all Swarm node keys, cloud credentials, and registry tokens accessible from the host
- Audit npm publish history for unexpected releases under accounts that ran on the compromised host
- Check lockfiles and CI logs for transitive pulls of 13.3.0
Sources
- GHSA-hh7j-5m3j-23pf: Malware in @ethersphere/bee-jsgithub.com
- ethersphere/bee-js#1294: npm package version 13.3.0 is compromisedgithub.com
Check your lockfile against this and every other incident.
Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.
