In November 2026, threat actors compromised Ethersphere's release pipeline, publishing malicious versions of the @ethersphere/bee-js npm package and Swarm Desktop releases. These trojanized artifacts contained loaders that fetched JavaScript with full Node.js privileges from a malicious server and used an Ethereum smart contract for command and control. The malware exfiltrated sensitive data such as Bee node passwords and wallet keys, and deployed backdoors and remote access tools targeting developers working with Ethereum tooling. The compromised releases were signed and published through legitimate workflows, making detection more difficult.