[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiKTj4Cqvxv4VjeisWZjkMcijO_Ir_bxTqejprK2y2Es":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"73e0d700-b374-431d-b9d1-67821c2c5812","malicious-npm-package-targets-swarm-wallet-data-via-stolen-release-credentials","fda2d695-b8d4-443c-9a7d-ca995b343477","Malicious npm Package Targets Swarm Wallet Data via Stolen Release Credentials","The @ethersphere\u002Fbee-js npm package version 13.3.0 was compromised after attackers likely stole the credentials of the 'bee-worker' release identity, allowing them to publish a trojanized version of the package. The malicious code executed during installation, targeting cryptocurrency wallet data and establishing persistence across multiple operating systems. This incident illustrates how package managers are high-value targets because developers implicitly trust published packages from known namespaces. Supply chain attacks of this kind are particularly dangerous because a single compromised package can affect thousands of downstream users simultaneously.","**Immediate actions:**\n- Audit and rotate all npm publish credentials and tokens, especially those associated with CI\u002FCD or automated release identities.\n- Remove or uninstall the compromised package version 13.3.0 immediately and inspect affected systems for signs of persistence or wallet data exfiltration.\n- Enable npm two-factor authentication (2FA) for all accounts with publish rights to public packages.\n\n**Long-term improvements:**\n- Implement package signing and integrity verification (e.g., npm provenance attestations) so consumers can cryptographically verify that published packages were built from a trusted source.\n- Enforce least-privilege principles for release identities by scoping publish tokens to specific packages and short expiry windows.\n- Pin exact dependency versions and use a software composition analysis (SCA) tool to alert on unexpected package changes before they reach production.\n\n**Detection measures:**\n- Monitor npm package releases for unexpected publish events or new versions outside of a defined release pipeline using tools like Socket.dev or similar supply-chain security scanners.\n- Implement runtime behavioral monitoring to detect scripts executing during package installation (install hooks) in development and CI environments.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement measures covering supply chain security, including the security of relationships with direct suppliers and service providers such as open-source package ecosystems.","Credential theft of the release identity (the likely root cause) is consistent with phishing or credential-harvesting techniques, underscoring the need for phishing-resistant authentication for privileged developer accounts.","SI-2 requires organizations to monitor for flaws in information systems and components, including third-party software, which covers tracking integrity of consumed open-source packages.","OWASP A06 specifically calls out the risk of using components from untrusted or unverified sources, and mandates integrity checks on packages—directly applicable to this compromised npm release.","Regularly scanning third-party dependencies for newly introduced malicious or vulnerable versions would have flagged the unexpected and unplanned 13.3.0 release before it was installed.","This control requires timely identification and remediation of technical vulnerabilities in software assets, which extends to vetting and monitoring open-source packages used in development pipelines.","The compromise stemmed from stolen publish credentials; enforcing MFA and scoped, short-lived tokens for the 'bee-worker' release identity would have prevented unauthorized publication.","published","2026-11-09T02:20:27.099214+00:00","2026-11-09T02:20:27.073+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fethersphere-bee-js-13-3-0-compromise","ethersphere-bee-js-13-3-0-compromised-46f78e","@ethersphere\u002Fbee-js 13.3.0 Compromised",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"10751627-3030-4906-98fa-103a975f1015","2026-11-09","morning","ThreatNoir Morning Brief — November 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-09\u002Fthreatnoir-morning-brief-2026-11-09.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]