Two Malicious Releases Hit Swarm Tools, Leak Wallet Keys and Secrets
Key Facts
Attackers published two malicious releases in the Swarm network’s tools on November 9, 2026: bee-js 13.3.0 and Swarm Desktop 0.56.2, exploiting Ethersphere’s release mechanism, according to a report by The Hacker News. The code targets the wallet key held by the Swarm Desktop application for its node and the stored password used to unlock it, and is also designed to install a backdoor on Windows, macOS and Linux systems. An Ethersphere comment accompanying the replacement release said the compromised desktop version was published by an attacker using stolen CI credentials. The Hacker News report warned that the code being downloaded and run operates with the user’s privileges. No reports of stolen funds had emerged when the report was published, according to the same source.
In the case of bee-js, version 13.3.0 remained the latest npm release for about 75 minutes, from 00:09 to 01:25 UTC on November 9, before it was withdrawn. Swarm Desktop 0.56.2 appeared on GitHub at around 00:36 UTC and remained available for about 8.5 hours before it was withdrawn. The two release windows show that the compromised versions reached two different distribution channels for the project’s tools on the same day. Ethersphere’s comment confirmed that the desktop release was published using stolen CI credentials, while The Hacker News report says the attackers used the project’s release mechanism to distribute the malicious versions. These details broaden the incident from a problem inside a single application to a compromise of Ethersphere’s software distribution process.
The impact described by the sources centers on users of Swarm tools and devices that ran the affected versions, not all Ethereum users. The code is designed to steal a Swarm node’s wallet key and saved password, while installing a backdoor on the three operating systems named. According to the GitHub advisory, any computer on which the affected package was installed should be treated as fully compromised, with all keys and secrets stored on it rotated immediately from another device. The advisory also warns that deleting the package alone does not guarantee removal of malware that has already been installed. The warning covers bee-js 13.3.0, while The Hacker News report also identifies Swarm Desktop 0.56.2 as an affected release.
The Ethersphere team released Swarm Desktop 0.56.3 on November 9, stating in the release notes that it replaces the compromised version 0.56.2. This release addresses the desktop application, but the available advisory does not offer a patched release of bee-js 13.3.0. The bee-js releases page showed version 13.2.0 as the latest visible release as of November 10, after 13.3.0 was withdrawn. Version 13.2.0 had been published on October 15, 2026, and the official GitHub record lists it as a release verified with a GitHub signature.
The GitHub advisory means anyone who ran bee-js 13.3.0 should not rely on removing the package alone, but should treat the device as compromised and rotate its keys and secrets from another computer. The advisory says using a different device matters because malware may remain on the computer that ran the package. Swarm Desktop users, meanwhile, received version 0.56.3 as a replacement for 0.56.2 on the day of the incident. By contrast, the official bee-js page lists version 13.2.0 as the latest as of November 10, with no newer patched release documented in the available information. No stolen funds had been reported when The Hacker News report was published, and the available evidence does not document any price movement linked to the incident.