Malicious bee-js 13.3.0 on npm tried to steal crypto wallet keys
Version 13.3.0 of the Swarm library @ethersphere/bee-js shipped through the project's own release pipeline and tried to steal wallet keys the moment it was installed.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesIf you installed @ethersphere/bee-js 13.3.0 from npm, the damage may have been done before your app ever ran. Security firm CodeScoring has flagged that version of the JavaScript library for the Swarm distributed storage network as malicious. Since 9 November, it has treated the release as malware that tried to steal crypto wallet keys.
What makes it nasty is how it got out. The bad version went through the project's normal publishing process. Someone committed code directly to the official repository under the release account bee-worker, then created a release, which fired the project's existing GitHub Actions workflow. According to Socket, the build data on npm pointed to the official repository and the standard release process. The malware was already in the source by then.
The attackers set it up so a script runs automatically on install. In the code comments, the call to their server was described as sending analytics. In reality the script downloaded JavaScript from that server and ran it at once, with the rights of whoever installed the package.
What did the bee-js malware do?
The payload looked inside Swarm Desktop data for an encrypted wallet key and a config file. If the config held the key's password, stealing the two files was enough to take over the wallet. It also tried to make itself persistent, so it would survive after installation finished.
On Linux and macOS it went further and installed a backdoor for running remote commands. The backdoor read its command server address from an Ethereum smart contract, so the operator could change the address with one transaction, with no new build needed.
How to check if you are affected
The bad version could also arrive indirectly. Dependency ranges in several Swarm tools allowed 13.3.0, so a search for a direct dependency in the manifest is not enough. Check the version actually resolved in your lock file.
Teams should look through lock files, package caches and CI install logs for 13.3.0. If it was installed with scripts allowed, or if Swarm Desktop 0.56.2 was run, the machine or CI runner needs investigating. On a CI runner, that means package publishing tokens and source access too.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
UTM game compatibility database uses a Claude Code agent to patch bugs
Russia's Roskomnadzor AI VPN filter cost 2.27 billion rubles
Amazon releases a tool written entirely by AI coding agents
