Key Takeaways (TL;DR): A malicious version (13.3.0) of the npm library @ethersphere/bee-js for the Swarm distributed storage was found to steal cryptocurrency wallet keys. The malware executed before the app even started, using a sneaky postinstall script. Always audit your dependencies and consider using a private, anti-DPI VPN key to secure your traffic β€” available in the Telegram bot @yavpn_robot.

On November 9, security researchers at CodeScoring flagged version 13.3.0 of the JavaScript library @ethersphere/bee-js as malicious. This library is used to interact with the Swarm distributed storage network, and the compromised version was published through the project's official release process β€” making it look completely legitimate.

How the Attack Worked

The attackers gained access to the bee-worker account on npm and pushed a direct commit to the official repository. They then created a release that triggered the existing GitHub Actions workflow. The malicious code was hidden in the source files and executed via a postinstall script β€” meaning it ran automatically when a developer installed the package, even before the application started.

What the Malware Did

Once installed, the malicious script downloaded a secondary payload that attempted to steal cryptocurrency wallet keys. It targeted common wallet files and browser extensions, scanning for private keys and seed phrases. The data was then exfiltrated to a remote server controlled by the attackers.

Why This Matters

This attack is particularly dangerous because it exploited the trust in the official npm registry and the project's own release pipeline. The malicious version had the same build metadata as legitimate releases, making it nearly impossible to detect without automated security scanning. Developers who installed or updated this package between November 9 and its removal were at risk.

How to Protect Yourself

  • Always verify package integrity using checksums or lockfiles.
  • Use automated dependency scanning tools like Socket or CodeScoring.
  • Consider using a private VPN with anti-DPI features to secure your development traffic β€” get a multi-key subscription from just 5 RUB/day in @yavpn_robot.