# Ethersphere withdraws malicious bee-js and Swarm Desktop releases

_Published Monday, November 9, 2026 at 1:43 PM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

![Ethersphere withdraws malicious bee-js and Swarm Desktop releases — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4ZFiesBwDTk8fRRfKfNIw0lLkhqF6ZAExRxuuRtfRCWrxs6Rg7M5UdSIcJqH2zstViFreL30JMmdebYTlMOKvg4D6GvaS70XPdembzyIZoX2KBj_S3kxKWmBjJll4exWUYXrap9IDW_ugXHOux5jZXk44_v5xac1mxFouywezDcsGeMdLrGd1sJStMoo/s1700-nu-rw-lo-l85-e365/bees.jpg)

Attackers used Ethersphere's release automation to publish bee-js 13.3.0 and Swarm Desktop 0.56.2 with code designed to steal node wallet keys and install backdoors. Both releases were withdrawn, and maintainers issued clean Swarm Desktop version 0.56.3 on Monday.

The malicious library ran code during installation, while the desktop app ran it at startup. The releases passed through legitimate publishing workflows; the desktop build also used the project's signing certificates. Maintainers have since required approval for signing jobs and restricted them to the main branch. Updating does not remove an installed backdoor or protect a stolen key. No theft of funds had been reported, and the number of infected machines remained unknown.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html)

---
Canonical: https://techandbusiness.org/newswire/NqCkVVmlGdUjjoyMfYSMs2
Published: 2026-11-09T18:43:04.729Z
Story chronology: 2026-11-09T00:09:00.000Z
Retrieved: 2026-11-09T20:53:23.212Z
Publisher: Tech & Business (techandbusiness.org)