Hackers Compromise Ethersphere's bee-js and Swarm Desktop with Malware

# Hackers Compromise Ethersphere's bee-js and Swarm Desktop with Malware

https://gcdradar.vercel.app/incidents/hackers-compromise-ethersphere-s-bee-js-and-swarm-desktop-wi · AIR-2026-1840 · live

- Lane: Supply chain
- Severity: 4 (Confirmed real-world loss): Malicious package with confirmed reach and credential theft impact.
- Fix status: No fix needed
- First reported: 2026-11-09
- AI role: No AI role
- Products: bee-js, Swarm Desktop

## Summary

Attackers compromised Ethersphere's release automation to publish malicious versions of bee-js and Swarm Desktop. The packages steal wallet keys, stored passwords, and install a backdoor.

## What to do

Downgrade or remove affected versions of bee-js and Swarm Desktop immediately and check for compromised wallet keys.

## Affected and fixed versions

- Affected: bee-js 13.3.0
- Affected: Swarm Desktop 0.56.2

## Latest updates

- 2026-11-09: Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware (https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html)

## Sources

- 2026-11-09 The Hacker News: Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.