@ethersphere/bee-js 13.3.0 Compromised
@ethersphere/bee-js 13.3.0 release contains malicious code targeting Swarm wallet data.
Run @ethersphere/bee-js?
Get an email when a reviewed story names @ethersphere/bee-js, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A compromised release of the @ethersphere/bee-js npm package, version 13.3.0, was published with malicious code. This code executes during installation, targeting Swarm Desktop wallet data and attempting to establish persistent access on Linux, macOS, and Windows systems. The compromise appears to stem from the misuse of the 'bee-worker' release identity, potentially due to stolen credentials.
The lesson from this incident
Full lessonThe @ethersphere/bee-js npm package version 13.3.0 was compromised after attackers likely stole the credentials of the 'bee-worker' release identity, allowing them to publish a trojanized version of the package. The malicious code executed during installation, targeting cryptocurrency wallet data and establishing persistence across multiple operating systems. This incident illustrates how package managers are high-value targets because developers implicitly trust published packages from known namespaces. Supply chain attacks of this kind are particularly dangerous because a single compromised package can affect thousands of downstream users simultaneously.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- domain — api.frameworkmetrics[.]xyz