Ethersphere bee-js · Exploitation confirmed

[Single source] Malicious bee-js and Swarm Desktop Releases Withdrawn, Backdoors Remain

Nov 09, 2026 · 1 min read

Attackers used the Ethersphere project's release automation to publish malicious versions of the bee-js npm package (13.3.0) and Swarm Desktop (0.56.2), tools for the Swarm decentralized storage network. The releases download and run code that steals the node's wallet key and the stored password that unlocks it, and install backdoors on Windows, macOS, and Linux. Both versions are withdrawn, but updating alone won't remove the backdoors; anyone who ran the packages should inspect machines and treat the wallet as compromised.

By HIFY Radar newsroom Updated 11/09/2026 03:04 PM Get this every day →← Back to the feed 2 sources

HighSupply chainExploitation confirmedPartial fix

In 30 seconds

Observed

Attackers abused Ethersphere's own release automation to publish malicious builds of two tools for the Swarm decentralized storage network: the bee-js npm package version 13.3.0 and Swarm Desktop 0.56.2. The tampered releases download and run code that steals the wallet key Swarm Desktop keeps for its node, along with the stored password that unlocks it, and they also install backdoors on Windows, macOS, and Linux. Both malicious versions have been withdrawn, but the reporting warns that updating alone will not remove backdoors already installed on a machine.

What happened

Alleged

According to The Hacker News, the attackers did not typosquat or fork the project: they used the Ethersphere project's own release automation to publish malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2, meaning the poisoned builds arrived through the project's official distribution channels.

Observed

Once installed, both releases download and execute code built to steal the wallet key Swarm Desktop stores for its node together with the stored password that unlocks it. The code is also built to install a backdoor, with the accompanying X post noting that the backdoors target Windows, macOS, and Linux. Both malicious versions have since been withdrawn.

Why it matters

Inferred

This is a supply-chain compromise of trusted, official release channels: anyone who installed bee-js 13.3.0 or updated Swarm Desktop to 0.56.2 received the malware directly from the project itself, so the version numbers and package provenance users normally rely on offered no warning.

Inferred

The combination of wallet-key theft plus persistent backdoors means affected users face both immediate risk to funds and ongoing remote access that survives the fix: which is why the reporting explicitly stresses that updating alone won't remove the backdoors.

What to do

Observed

The most concrete guidance in the evidence: do not assume you are safe just because the malicious versions have been withdrawn: The Hacker News states explicitly that 'updating alone won't remove the backdoors.'

Inferred

From the described behavior, prudent follow-up steps follow: check whether bee-js 13.3.0 or Swarm Desktop 0.56.2 was installed on any machine; treat any wallet whose key or unlock password was stored in Swarm Desktop on an affected host as compromised and move funds to a fresh wallet; and inspect Windows, macOS, and Linux systems for the reported backdoors before considering them clean. These steps are derived from the reporting, not quoted from it.

Confirmed and still uncertain

Observed

Established in the evidence: the affected versions (bee-js 13.3.0 and Swarm Desktop 0.56.2), the delivery vector (the project's own release automation), the payload behavior (theft of the node wallet key and its unlocking password, plus backdoor installation on Windows, macOS, and Linux), and the fact that both versions have been withdrawn.

Inferred

Not covered by the evidence: how the release automation was compromised, who is behind the campaign, how many users installed the malicious builds, the full capabilities of the backdoor (the captured article text cuts off mid-description), whether any wallets have actually been drained, and what remediation the project or npm recommends beyond withdrawing the versions.

What people are saying

Observed

The Hacker News promoted its own reporting on X, writing: 'Hackers compromised Ethersphere's bee-js npm package and Swarm Desktop app to deliver crypto wallet-stealing malware,' adding that the malicious releases also install backdoors on Windows, macOS, and Linux, and that 'both versions are now withdrawn, but updating alone won't remove the backdoors.'

Inferred

No statements from Ethersphere maintainers, npm or Swarm operators, security researchers, or victims appear in the evidence batch, so the captured public discussion is limited to a single outlet's coverage and its own amplification of it.

Evolution

Observed

The article and its companion X post were captured within roughly a minute of each other: timestamps corresponding to November 8, 2026, with the post following the article by about 40 seconds. By the time of the X post, both malicious versions had already been withdrawn; the evidence batch does not include the initial publication of the malicious builds or the moment they were pulled.

Reach

Observed

1 independent groups, 2 updates, and 3 engagements.

Technical detail

Observed

bee-js is described in the reporting as one of Ethersphere's tools for Swarm, a decentralized storage network, distributed as an npm package; the malicious release was version 13.3.0. Its companion, Swarm Desktop 0.56.2, is the desktop application for running a Swarm node and was the second compromised release.

Observed

As described, the payload mechanics are: the tampered releases download and run code that exfiltrates the wallet key Swarm Desktop stores for its node, together with the stored password that unlocks it, and the same code is built to install backdoors spanning Windows, macOS, and Linux.

Sources and evidence

Observed

This brief is built on two evidence items: the primary source, the The Hacker News article 'Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware' (captured via RSS), and a discussion item, the @TheHackersNews X post linking to that same article, published seconds later.

Observed

Caveats on the evidence: the captured article body is truncated mid-sentence ('The code is also built to install a backdoor'), so portions of the original report: backdoor details, attribution, and remediation guidance: are not available here. Both items originate from the same outlet, so key claims, including that the project's own release automation was abused, are effectively single-source and uncorroborated within this batch.