[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnBYjBGgc39Hma1HE2N9VwPPJvXza92jaLfcGts6gZyI":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"fda2d695-b8d4-443c-9a7d-ca995b343477","@ethersphere\u002Fbee-js 13.3.0 Compromised","ethersphere-bee-js-13-3-0-compromised-46f78e","@ethersphere\u002Fbee-js 13.3.0 is compromised. Malicious install-time code targets Swarm wallet data and attempts to establish persistent access on affected systems.","A compromised release of the @ethersphere\u002Fbee-js npm package, version 13.3.0, was published with malicious code. This code executes during installation, targeting Swarm Desktop wallet data and attempting to establish persistent access on Linux, macOS, and Windows systems. The compromise appears to stem from the misuse of the 'bee-worker' release identity, potentially due to stolen credentials.","@ethersphere\u002Fbee-js 13.3.0 release contains malicious code targeting Swarm wallet data.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fethersphere-bee-js-13-3-0-compromise","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af11b1a3bceb5d0377ffb77_ethersphere-bee-js-13-3-0-compromised-cover.png","2026-11-09T01:18:18+00:00","2026-11-09T02:00:32.421098+00:00",9,[17,20,22,25],{"name":18,"type":19},"@ethersphere\u002Fbee-js","product",{"name":21,"type":19},"Swarm Desktop",{"name":23,"type":24},"npm","technology",{"name":26,"type":24},"JavaScript","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"domain","api.frameworkmetrics[.]xyz","C2 domain used by malicious @ethersphere\u002Fbee-js 13.3.0 release to download payloads.",[18,21],{"controls":57,"vendors":143},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":88,"name":89,"problem":90,"products":91},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,129,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"malicious-npm-package-targets-swarm-wallet-data-via-stolen-release-credentials","Malicious npm Package Targets Swarm Wallet Data via Stolen Release Credentials","The @ethersphere\u002Fbee-js npm package version 13.3.0 was compromised after attackers likely stole the credentials of the 'bee-worker' release identity, allowing them to publish a trojanized version of the package. The malicious code executed during installation, targeting cryptocurrency wallet data and establishing persistence across multiple operating systems. This incident illustrates how package managers are high-value targets because developers implicitly trust published packages from known namespaces. Supply chain attacks of this kind are particularly dangerous because a single compromised package can affect thousands of downstream users simultaneously.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":157,"MITRE ATT&CK T1566: Phishing":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"OWASP A06:2021 Vulnerable and Outdated Components":160,"CIS Control 7: Continuous Vulnerability Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 requires entities to implement measures covering supply chain security, including the security of relationships with direct suppliers and service providers such as open-source package ecosystems.","Credential theft of the release identity (the likely root cause) is consistent with phishing or credential-harvesting techniques, underscoring the need for phishing-resistant authentication for privileged developer accounts.","SI-2 requires organizations to monitor for flaws in information systems and components, including third-party software, which covers tracking integrity of consumed open-source packages.","OWASP A06 specifically calls out the risk of using components from untrusted or unverified sources, and mandates integrity checks on packages—directly applicable to this compromised npm release.","Regularly scanning third-party dependencies for newly introduced malicious or vulnerable versions would have flagged the unexpected and unplanned 13.3.0 release before it was installed.","This control requires timely identification and remediation of technical vulnerabilities in software assets, which extends to vetting and monitoring open-source packages used in development pipelines.","The compromise stemmed from stolen publish credentials; enforcing MFA and scoped, short-lived tokens for the 'bee-worker' release identity would have prevented unauthorized publication."]