--- title: @ethersphere/bee-js 13.3.0 Compromised | daily.dev description: Version 13.3.0 of @ethersphere/bee-js is compromised with malicious install-time code. The release includes an installation hook that downloads and executes... canonical: https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: @ethersphere/bee-js 13.3.0 Compromised | daily.dev og:description: Version 13.3.0 of @ethersphere/bee-js is compromised with malicious install-time code. The release includes an installation hook that downloads and executes... og:url: https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp og:image: https://api.daily.dev/og/posts/47d6iSIBP.png og:image:alt: @ethersphere/bee-js 13.3.0 Compromised og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # @ethersphere/bee-js 13.3.0 Compromised **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 1 min read · 0 upvotes · 0 comments ## Summary Version 13.3.0 of @ethersphere/bee-js is compromised with malicious install-time code. The release includes an installation hook that downloads and executes remote JavaScript. Analyzed payloads target Swarm Desktop wallet material and attempt to establish persistent access on affected systems. The package recorded 3,560 downloads across all versions during November 1 to 7, 2026, though that figure does not reflect downloads of the compromised 13.3.0 release specifically. StepSecurity is still investigating and plans to publish a detailed technical report. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is @ethersphere/bee-js version 13.3.0 safe to install? No, version 13.3.0 of @ethersphere/bee-js is compromised. It contains an installation hook that downloads and executes remote JavaScript, with payloads that target Swarm Desktop wallet material and attempt to establish persistent access on affected systems. The package logged 3,560 downloads across all versions between November 1 and 7, 2026, though that total is not specific to the compromised release. _Teams vetting npm dependencies can track emerging supply chain compromises like this one on daily.dev._ ### What does the malicious code in the compromised bee-js npm package do? It runs at install time, downloading and executing remote JavaScript rather than bundling the payload directly in the package. The analyzed payloads specifically target Swarm Desktop wallet material and attempt to establish persistent access on infected machines, rather than just exfiltrating data once. _Developers investigating supply chain malware patterns can follow writeups like this on daily.dev._ ## Similar posts on daily.dev - [Multiple redhat-cloud-services npm packages compromised \(StepSecurity Blog\)](https://daily.dev/posts/multiple-redhat-cloud-services-npm-packages-compromised-stepsecurity-blog--prno3btx5) · LWN.net · 0 upvotes · 0 comments - [jscrambler npm package publishes malicious preinstall binary](https://daily.dev/posts/jscrambler-npm-package-publishes-malicious-preinstall-binary-hv0avwili) · StepSecurity · 2 upvotes · 0 comments - [Injective SDK on npm infected with cryptocurrency wallet stealer](https://daily.dev/posts/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-2u95ebyn1) · BleepingComputer · 0 upvotes · 0 comments - [Compromised Injective SDK npm Package Exfiltrates Wallet Key...](https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw) · Socket · 1 upvotes · 0 comments - [Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer](https://daily.dev/posts/mini-shai-hulud-targets-sap-npm-packages-with-a-bun-based-secret-stealer-klxyhwkh8) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"@ethersphere/bee-js 13.3.0 Compromised","url":"https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp"},"datePublished":"2026-11-09T01:08:18.020Z","dateModified":"2026-11-09T16:37:38.415Z","description":"Version 13.3.0 of @ethersphere/bee-js is compromised with malicious install-time code. The release includes an installation hook that downloads and executes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/972a1eb64ec3a47da7b1b0e4c0fc1c4a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/972a1eb64ec3a47da7b1b0e4c0fc1c4a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"@ethersphere/bee-js 13.3.0 Compromised"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ethersphere-bee-js-13-3-0-compromised-47d6isibp#faq","mainEntity":[{"@type":"Question","name":"Is @ethersphere/bee-js version 13.3.0 safe to install?","acceptedAnswer":{"@type":"Answer","text":"No, version 13.3.0 of @ethersphere/bee-js is compromised. It contains an installation hook that downloads and executes remote JavaScript, with payloads that target Swarm Desktop wallet material and attempt to establish persistent access on affected systems. The package logged 3,560 downloads across all versions between November 1 and 7, 2026, though that total is not specific to the compromised release. Teams vetting npm dependencies can track emerging supply chain compromises like this one on daily.dev."}},{"@type":"Question","name":"What does the malicious code in the compromised bee-js npm package do?","acceptedAnswer":{"@type":"Answer","text":"It runs at install time, downloading and executing remote JavaScript rather than bundling the payload directly in the package. The analyzed payloads specifically target Swarm Desktop wallet material and attempt to establish persistent access on infected machines, rather than just exfiltrating data once. Developers investigating supply chain malware patterns can follow writeups like this on daily.dev."}}]} ```