Skip to content
Ethersphere npm Package Compromised with Crypto Malware

Ethersphere npm Package Compromised with Crypto Malware

First seen 9 Nov 2026, 12:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 12:10 UTC
  • •Version 13.3.0 of @ethersphere/bee-js is compromised, executing malware on installation.
  • •Attackers used a compromised developer access key to inject malicious code into npm and GitHub.
  • •Users should avoid installing the compromised version and investigate potential wallet compromises.

On November 9, 2026, the @ethersphere/bee-js npm package version 13.3.0 was found to be compromised, executing attacker-controlled JavaScript during installation. The malicious code targets Swarm Desktop wallet files and installs persistent access on Linux, macOS, and Windows systems. The malicious commit was made using a compromised developer access key, allowing the attackers to inject code into both the npm package and the official GitHub repository. The npm package recorded 3,560 downloads prior to the malicious release, and the GitHub release was downloaded 44 times before the publication. The command-and-control (C2) server, frameworkmetrics[.]xyz, was registered shortly before the attack, indicating premeditated planning. Users are advised not to install version 13.3.0 and to treat affected systems as potentially compromised. The malicious release has been revoked, but the GitHub version remains accessible.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-11-08
Malicious commit made
A malicious commit was made to the @ethersphere/bee-js repository using a compromised developer access key.
StepSecurity
2026-11-09
Malicious package published
The compromised version 13.3.0 of @ethersphere/bee-js was published to npm, executing malicious code during installation.
StepSecurity
2026-11-09
Attack disclosed
OX Security reported the coordinated supply chain compromise affecting the Ethersphere ecosystem.
Ox.Security

More articles in this cluster (6)

Following this threat?

Track Evjawbreaker and ConnectWise in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (28)

1 / 3

Common questions

What should I do if I installed version 13.3.0?
Do not use the package and investigate your system for potential compromise, especially regarding cryptocurrency wallets.
How can I check if my system was affected?
Review your installed dependencies and lockfiles for the compromised package version and check for any unusual activity.
Is the malicious code still accessible?
Yes, the malicious GitHub release version remains accessible, even though the npm package has been revoked.