# SZB-5ab74d9eed: Ethersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malware

Attackers used the Ethersphere project's own release automation to publish malicious bee-js 13.3.0 and Swarm Desktop 0.56.2, according to the report. The code is described as stealing the wallet key and stored password for Swarm Desktop nodes and installing a backdoor.

- Type: Early warning
- Kind: Malicious package
- Vendor: Ethersphere
- Product: bee-js
- Status: Reported, not confirmed
- Sources: 2 distinct
- First seen: 2026-11-09 13:06 UTC

> No statement or filing from Ethersphere has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Do not install or run bee-js 13.3.0 or Swarm Desktop 0.56.2
- Move funds from any Swarm Desktop node wallet to a new key you create on a clean system
- Check systems that ran these versions for a backdoor and rotate exposed passwords
- Reinstall from a verified official release once the project confirms a clean build

## Timeline

- 2026-11-09 13:05 UTC: Made public by Mastodon
- 2026-11-09 13:06 UTC: First seen by cve.now

## Evidence (2 sources)

- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@threatnoir/117586627817951635): “The @ethersphere/bee-js npm package version 13.3.0 was published with malicious code that executes during installation.”
- 2026-11-09 · Press · [The Hacker News](https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html): “Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-5ab74d9eed&body=https%3A%2F%2Fcve.now%2FSZB-5ab74d9eed%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-5ab74d9eed

### Has Ethersphere confirmed it?

Mastodon and The Hacker News report it. No statement from Ethersphere has reached cve.now yet.

Source: https://infosec.exchange/@threatnoir/117586627817951635, https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html

### What should Ethersphere users do?

Do not install or run bee-js 13.3.0 or Swarm Desktop 0.56.2. Move funds from any Swarm Desktop node wallet to a new key you create on a clean system. Check systems that ran these versions for a backdoor and rotate exposed passwords. Reinstall from a verified official release once the project confirms a clean build.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-5ab74d9eed
Site guide for agents: https://cve.now/llms.txt