Swarm bee-js and Swarm Desktop Compromised: How to Protect Node Wallets

Quick answer: On 9 November 2026, attackers pushed a malicious bee-js 13.3.0 package to npm and a trojanized Swarm Desktop 0.56.2 release that stole Swarm node wallet keys and passwords and installed a backdoor. If you installed either version, treat the machine as compromised, move node funds to a new key, and reinstall clean versions (bee-js 13.2.0, Swarm Desktop 0.56.3).

What happened

Swarm is a decentralized storage network built by Ethersphere, closely tied to the Ethereum ecosystem. Node operators run Bee nodes, often through the Swarm Desktop app, and fund them with xDAI for gas and xBZZ for storage.

The Hacker News reported on 9 November that attackers compromised the project's release process and shipped two poisoned builds:

• bee-js 13.3.0, the JavaScript library developers use to talk to Bee nodes, published to npm between about 00:09 and 01:25 UTC on 9 November.
• Swarm Desktop 0.56.2, released on GitHub around 00:36 UTC on 9 November and withdrawn roughly 8.5 hours later.

According to SafeDep's technical analysis, published on 9 November and updated on 11 November, the attackers did not steal an npm token. Instead they used two GitHub accounts linked to the project, a release bot and a long-time maintainer, to trigger the normal release workflow. That means the malicious npm package carried valid provenance, and the desktop build was signed with the project's real certificates.

How it reached users

• Developers who installed or updated bee-js during the window got the bad version. Tools such as swarm-cli and bee-dashboard accepted version ranges that included 13.3.0, according to The Hacker News.
• Swarm Desktop's auto-updater could push 0.56.2 to Windows x64 and Apple Silicon Macs within minutes. The Hacker News reported that Intel Macs were not offered the update and that Linux builds do not auto-update.

What the malware stole

Both builds ran a small loader, either as an npm install script or at app startup, which downloaded a second-stage payload. SafeDep and The Hacker News describe the payload as reading two files from the Swarm data directory:

• config.yaml, which contains the node's keystore password in plain text.
• keys/swarm.key, the node's encrypted wallet key.

With both, an attacker can decrypt the node's wallet and take its xDAI and xBZZ, chequebook balance and any stake. Default data folders are:

• Linux: ~/.local/share/Swarm Desktop
• macOS: ~/Library/Application Support/Swarm Desktop
• Windows: %LOCALAPPDATA%\Swarm Desktop\Data

The backdoor

The researchers also found persistence. On Linux and macOS, the malware installed a remote shell in a hidden ~/.solidity/ folder, kept alive by a systemd user service or a macOS LaunchAgent. On Windows, it installed a ScreenConnect remote-access client as a system service. SafeDep notes that the command server's address is read from an Ethereum smart contract, so it can be changed at any time.

Cryptonomist reported on 10 November that security firm SlowMist also issued a warning and advised removing the package, reverting to 13.2.0 and replacing wallet keys.

Who is affected

• Developers who ran npm install or npm update on a project depending on bee-js during the window, with install scripts enabled.
• Swarm Desktop users on Windows or Apple Silicon Macs whose app auto-updated to 0.56.2, or anyone who manually installed it.
• CI servers and build machines that pulled bee-js 13.3.0.

If you never installed either version, you are not affected by this incident, though you should still pin versions going forward.

How to check whether you were affected

Step 1: Check installed versions

• In each JavaScript project, run npm ls @ethersphere/bee-js and look for 13.3.0.
• Search lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for 13.3.0.
• In Swarm Desktop, check the version number in the app's about or settings screen.

Step 2: Look for indicators of compromise

• Check for a hidden ~/.solidity/ folder on Linux or macOS.
• Look for a systemd user unit or LaunchAgent with "solidity" and "langsupport" in its name.
• On Windows, look for an unexpected "ScreenConnect Client" service.
• Review network logs for connections to api.frameworkmetrics[.]xyz, the domain listed in published indicators.

What to do if you were affected

Step 3: Move funds to a fresh key first

• From a clean device, create a new wallet that has never touched the affected machine.
• Transfer remaining xDAI, xBZZ and any withdrawable chequebook funds to it as soon as possible.
• Assume the old node key and password are known to the attacker.

Step 4: Clean or rebuild the machine

• Because a backdoor was installed, updating bee-js or Swarm Desktop does not fix the problem. The safest course is to wipe and reinstall the operating system.
• Rotate any other secrets stored on that machine: SSH keys, API tokens, cloud credentials and other wallet files.

Step 5: Reinstall clean versions

• Pin @ethersphere/bee-js to 13.2.0 or a later version confirmed clean by Ethersphere.
• Install Swarm Desktop 0.56.3 from the official Ethersphere GitHub release.
• Consider running npm install --ignore-scripts in sensitive environments.

The same principle applied in other recent incidents: when keys may have been exposed, move funds first, then clean up. See our guides on the LNbits security update and resetting wallet keys and the FomoPeek iOS wallet key exposure.

What to avoid

• Do not just upgrade and move on. The backdoor survives package updates.
• Do not reuse the old node key after moving funds.
• Do not copy the old data directory to a new machine. It contains the compromised key and plaintext password.
• Do not run unknown developer tools from tutorials or repositories you have not verified. Our report on fake AI crypto bot tutorials that deploy drainer contracts shows how often this happens.

Lessons for on-chain developers

This attack shows that a signed package with valid provenance can still be malicious if the publisher's accounts are compromised. Practical steps:

• Pin exact versions and commit lockfiles.
• Review new releases of critical dependencies before upgrading, especially point releases published outside normal hours.
• Keep wallet keys off developer laptops and build servers where possible.
• Never store keystore passwords in plain text on the same machine as the key.

For a related front-end attack, see our walkthrough of the Across domain hijack and revoking token approvals.

Frequently asked questions

Conclusion

The bee-js and Swarm Desktop compromise is a serious supply-chain attack aimed squarely at node wallet keys. If you installed bee-js 13.3.0 or Swarm Desktop 0.56.2, move your node funds to a fresh key from a clean device, rebuild the affected machine, and reinstall only the official clean versions.

The Onchain Support is an independent educational site and is not affiliated with Ethersphere, Swarm or any exchange. This article is general information, not financial or security advice for your specific setup. We will never ask for your seed phrase, private keys, passwords or 2FA codes.