The bee-js Swarm Desktop compromise hit two official releases on 9 November 2026 in what fits the pattern of a supply chain attack on an open-source project’s own release process. The @ethersphere/bee-js npm package, version 13.3.0, and the Swarm Desktop app, version 0.56.2, were both published through the project’s own release pipeline. Both carried code that steals a Swarm node’s wallet key and installs a backdoor.
If you installed bee-js 13.3.0, or you run Swarm Desktop 0.56.2, treat that machine as compromised. Move to bee-js 13.2.0 and Swarm Desktop 0.56.3 now, and do not stop at removing the package.
bee-js Swarm Desktop Compromise: Which Versions Are Affected?
GitHub’s Advisory Database lists GHSA-hh7j-5m3j-23pf for the npm package: affected versions >= 13.3.0, with no patched version, because the package was removed rather than fixed. No version at or above 13.3.0 has ever been published besides it. The npm registry’s own record shows version 13.3.0 no longer listed, and the “latest” tag pointing back to 13.2.0, published 15 October 2026.
| Release | Affected version | Clean version |
|---|---|---|
| @ethersphere/bee-js (npm) | 13.3.0 (no higher version exists) | 13.2.0 (current, no fixed build of 13.3.0 exists) |
| Swarm Desktop (desktop app) | 0.56.2 only | 0.56.3 |
Ethersphere’s own release notes for Swarm Desktop 0.56.3, published the same day, list the fix as “replace compromised 0.56.2 release,” in the project’s own words. That line, in a signed release from the project itself, is the closest thing to an official notice this story has.
What the Compromised Code Did
Security firm StepSecurity says it found the compromise and reported it to the maintainers and to npm. It traces the bee-js change to a commit made under the project’s own release-bot identity, outside the normal reviewed release process. StepSecurity says the evidence points to misuse of the release-bot identity, but it does not establish whether a stolen credential or a token caused it.
The change added a script that runs automatically when the package installs, the kind of behavior Brandefense’s own malicious package entry describes. It downloads code from an attacker-controlled server and runs it with full access to the installing system, StepSecurity says. Ethersphere’s own release notes for 0.56.3 list the fix as replacing the compromised 0.56.2 release, without describing how its malicious code ran.
A project’s own release process has been turned against its users before. The Shai-Hulud npm worm is an earlier example on the same registry.
On a machine where either version actually ran, StepSecurity says the downloaded code looks for the Swarm node’s locally stored private key and the password needed to decrypt it. It then tries to install a backdoor that survives a restart. On Windows, StepSecurity says the payload tries to install additional persistence, but could not confirm the installer’s identity or how it obtains administrator rights.
Do This Now
- Check what you actually ranLook in lockfiles, package caches and CI logs for bee-js 13.3.0, and check Swarm Desktop’s own version number if you run it.
- Treat a match as compromisedIf either version installed or ran with scripts enabled, do not just remove it or update it. The code already ran.
- Move wallet funds from a clean machineIf Swarm Desktop ever ran on the affected machine, assume its node wallet key and password were read, and move any funds to a new key created elsewhere.
- Look for the backdoorCheck for a background service or scheduled task you did not create, and for an unexpected remote-support client. Reinstalling the app alone will not remove it.
- Rotate reachable credentialsRotate any other passwords, tokens or keys that were reachable from the affected machine or CI job.
- Update to the clean versionPin bee-js to 13.2.0 and update Swarm Desktop to 0.56.3. Linux Swarm Desktop packages do not auto-update and need a manual reinstall.
No public report says how many wallets lost funds; StepSecurity’s own report says the number of affected installations has not been established. Treat the checklist above as the response regardless of that count, since the compromised code ran with full access wherever it executed.
Frequently Asked Questions
Which bee-js version is affected, and which is safe?
Version 13.3.0 is affected, and no patched build of it, or of any higher version, exists. The npm registry's current "latest" version is 13.2.0, published before the compromise.
Which Swarm Desktop version is affected, and which is safe?
Only version 0.56.2 is affected. Ethersphere's own release notes list 0.56.3 as the fix, published the same day, 9 November 2026.
Is removing the package or updating the app enough?
No. StepSecurity says the code runs during install or at every app launch. If either version ran, treat the machine as compromised and follow the full checklist, not just an update.
Who found this compromise?
Security firm StepSecurity says its automated tool found it and that it reported the compromise to the project's maintainers and to npm.
