@ethersphere/bee-js 13.3.0 Compromised

The npm package @ethersphere/bee-js version 13.3.0 was compromised and published with malicious code that executes during installation. The postinstall script retrieves platform-specific JavaScript payloads from an attacker-controlled domain, which target Swarm Desktop wallet data for exfiltration and establish persistence on Linux, macOS, and Windows systems. The attack leveraged a compromised release identity (bee-worker), with the malicious commit bypassing normal signed pull request workflows, and the package was published with valid SLSA provenance, making detection more difficult.

AI-extracted · verify before operational use