npm / @ethersphere/bee-js / 13.3.0

@ethersphere/bee-js 13.3.0

Riskmedium Vulnsnone

processes: 892
operations: 83K
packages: 683
compiler runs: 0
connections: 3
job time: 51s
capture: 1.7 MB
records: 156K
bytes / record: 10.6

run d7b223ab-d0a3-4502-b780-0a915d7c1b37 · built 2026-11-09 · complete View on npm Release

Graph

egress · medium

Checks

16 of 19 clear · 1 not checked Network activity Build-time dependency advisories

Build behavior▲✓✓✓✓✓✓✓✓✓

Supply chain✓▲✓✓✓✓✓

Build hardening○

Pipeline✓

Detections

Build script reached api.frameworkmetrics.xyz

@ethersphere/bee-js 13.3.0 › api.frameworkmetrics.xyz:443

medium

Network

3 peers

api.frameworkmetrics.xyz:443 build code of @ethersphere/bee-js · node (consumer) · Cloudflare, Inc. · 2 files undeclared
github.com:443 @ethersphere/bee-js's own build code · git-remote-http via GitHub Runner profile (git-remote-https → github.com) · GitHub, Inc. · 2 files infrastructure
registry.npmjs.org:8080 the package manager · node (consumer) · 26,681 files ecosystem

Vulnerabilities6		Fix	Severity
Dependencies
brace-expansion 1.1.18, 2.1.4 dev		>=1.1.21
CVE-2026-102276	brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion		high
CVE-2026-102278	brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion		high
CVE-2026-102277	brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service		medium
glob 10.5.0 dev		>=14.0.2
CVE-2026-118773	Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal		medium
minimatch 7.4.9, 9.0.9 dev		>=11.0.1
CVE-2026-118764	minimatch has potential denial of service via globparts amplification		medium
deepmerge 4.3.1 dev		none published
CVE-2026-93753	deepmerge mergeObject() allows prototype poisoning of returned objects		low

Dependencies757	Build behavior
@asamuzakjp/css-color3.2.0
@babel/cli7.25.9
@babel/code-frame7.29.7
@babel/compat-data7.28.6
@babel/core7.29.6
@babel/generator7.29.7
@babel/helper-annotate-as-pure7.25.9
@babel/helper-builder-binary-assignment-operator-visitor7.25.9
@babel/helper-compilation-targets7.28.6
@babel/helper-create-class-features-plugin7.25.9
@babel/helper-create-regexp-features-plugin7.25.9
@babel/helper-define-polyfill-provider0.6.3
@babel/helper-globals7.28.0
@babel/helper-member-expression-to-functions7.25.9
@babel/helper-module-imports7.28.6
@babel/helper-module-transforms7.28.6
@babel/helper-optimise-call-expression7.25.9
@babel/helper-plugin-utils7.28.6
@babel/helper-remap-async-to-generator7.25.9
@babel/helper-replace-supers7.25.9
@babel/helper-simple-access7.25.9
@babel/helper-skip-transparent-expression-wrappers7.25.9
@babel/helper-string-parser7.29.7
@babel/helper-validator-identifier7.29.7
@babel/helper-validator-option7.27.1
@babel/helper-wrap-function7.25.9
@babel/helpers7.29.7
@babel/parser7.29.7
@babel/plugin-bugfix-firefox-class-in-computed-class-key7.25.9
@babel/plugin-bugfix-safari-class-field-initializer-scope7.25.9
@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression7.25.9
@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining7.25.9
@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly7.25.9
@babel/plugin-proposal-class-properties7.18.6
@babel/plugin-proposal-private-property-in-object7.21.0-placeholder-for-preset-env.2
@babel/plugin-syntax-async-generators7.8.4
@babel/plugin-syntax-bigint7.8.3
@babel/plugin-syntax-class-properties7.12.13
@babel/plugin-syntax-class-static-block7.14.5
@babel/plugin-syntax-import-assertions7.26.0
@babel/plugin-syntax-import-attributes7.26.0
@babel/plugin-syntax-import-meta7.10.4
@babel/plugin-syntax-json-strings7.8.3
@babel/plugin-syntax-jsx7.28.6
@babel/plugin-syntax-logical-assignment-operators7.10.4
@babel/plugin-syntax-nullish-coalescing-operator7.8.3
@babel/plugin-syntax-numeric-separator7.10.4
@babel/plugin-syntax-object-rest-spread7.8.3
@babel/plugin-syntax-optional-catch-binding7.8.3
@babel/plugin-syntax-optional-chaining7.8.3
@babel/plugin-syntax-private-property-in-object7.14.5
@babel/plugin-syntax-top-level-await7.14.5
@babel/plugin-syntax-typescript7.28.6
@babel/plugin-syntax-unicode-sets-regex7.18.6
@babel/plugin-transform-arrow-functions7.25.9
@babel/plugin-transform-async-generator-functions7.25.9
@babel/plugin-transform-async-to-generator7.25.9
@babel/plugin-transform-block-scoped-functions7.25.9
@babel/plugin-transform-block-scoping7.25.9
@babel/plugin-transform-class-properties7.25.9
@babel/plugin-transform-class-static-block7.26.0
@babel/plugin-transform-classes7.25.9
@babel/plugin-transform-computed-properties7.25.9
@babel/plugin-transform-destructuring7.25.9
@babel/plugin-transform-dotall-regex7.25.9
@babel/plugin-transform-duplicate-keys7.25.9
@babel/plugin-transform-duplicate-named-capturing-groups-regex7.25.9
@babel/plugin-transform-dynamic-import7.25.9
@babel/plugin-transform-exponentiation-operator7.25.9
@babel/plugin-transform-export-namespace-from7.25.9
@babel/plugin-transform-for-of7.25.9
@babel/plugin-transform-function-name7.25.9
@babel/plugin-transform-json-strings7.25.9
@babel/plugin-transform-literals7.25.9
@babel/plugin-transform-logical-assignment-operators7.25.9
@babel/plugin-transform-member-expression-literals7.25.9
@babel/plugin-transform-modules-amd7.25.9
@babel/plugin-transform-modules-commonjs7.25.9
@babel/plugin-transform-modules-systemjs7.29.4
@babel/plugin-transform-modules-umd7.25.9
@babel/plugin-transform-named-capturing-groups-regex7.25.9
@babel/plugin-transform-new-target7.25.9
@babel/plugin-transform-nullish-coalescing-operator7.25.9
@babel/plugin-transform-numeric-separator7.25.9
@babel/plugin-transform-object-rest-spread7.25.9
@babel/plugin-transform-object-super7.25.9
@babel/plugin-transform-optional-catch-binding7.25.9
@babel/plugin-transform-optional-chaining7.25.9
@babel/plugin-transform-parameters7.25.9
@babel/plugin-transform-private-methods7.25.9
@babel/plugin-transform-private-property-in-object7.25.9
@babel/plugin-transform-property-literals7.25.9
@babel/plugin-transform-regenerator7.25.9
@babel/plugin-transform-regexp-modifiers7.26.0
@babel/plugin-transform-reserved-words7.25.9
@babel/plugin-transform-runtime7.25.9
@babel/plugin-transform-shorthand-properties7.25.9
@babel/plugin-transform-spread7.25.9
@babel/plugin-transform-sticky-regex7.25.9
@babel/plugin-transform-template-literals7.25.9
@babel/plugin-transform-typeof-symbol7.25.9
@babel/plugin-transform-typescript7.25.9
@babel/plugin-transform-unicode-escapes7.25.9
@babel/plugin-transform-unicode-property-regex7.25.9
@babel/plugin-transform-unicode-regex7.25.9
@babel/plugin-transform-unicode-sets-regex7.25.9
@babel/preset-env7.26.0
@babel/preset-modules0.1.6-no-external-plugins
@babel/preset-typescript7.26.0
@babel/runtime7.29.2
@babel/template7.29.7
@babel/traverse7.29.0
@babel/types7.29.7
@bcoe/v8-coverage0.2.3
@commitlint/cli21.2.3
@commitlint/config-conventional20.5.3
@commitlint/config-conventional21.2.3
@commitlint/config-validator21.2.3
@commitlint/ensure21.2.3
@commitlint/execute-rule21.0.1
@commitlint/format21.2.3
@commitlint/is-ignored21.2.3
@commitlint/lint21.2.3
@commitlint/load21.2.3
@commitlint/message21.2.0
@commitlint/parse21.2.3
@commitlint/read21.2.3
@commitlint/resolve-extends21.2.3
@commitlint/rules21.2.3
@commitlint/to-lines21.0.1
@commitlint/top-level21.2.0
@commitlint/types20.5.0
@commitlint/types21.2.3
@conventional-changelog/git-client3.2.0
@conventional-changelog/template1.4.0
@cspotcode/source-map-support0.8.1
@csstools/color-helpers5.1.0
@csstools/css-calc2.1.4
@csstools/css-color-parser3.1.0
@csstools/css-parser-algorithms3.0.5
@csstools/css-tokenizer3.0.4
@discoveryjs/json-ext1.1.0
@eslint-community/eslint-utils4.4.1
@eslint-community/regexpp4.12.1
@eslint/eslintrc2.1.4
@eslint/js8.57.1
@ethersphere/core-sdk0.3.0
@humanwhocodes/config-array0.13.0
@humanwhocodes/module-importer1.0.1
@humanwhocodes/object-schema2.0.3
@isaacs/cliui8.0.2
@istanbuljs/load-nyc-config1.1.0
@istanbuljs/schema0.1.3
@jest/console30.4.1
@jest/core30.4.2
@jest/diff-sequences30.4.0
@jest/environment30.4.1
@jest/environment-jsdom-abstract30.4.1
@jest/expect30.4.1
@jest/expect-utils30.4.1
@jest/fake-timers30.4.1
@jest/get-type30.1.0
@jest/globals30.4.1
@jest/pattern30.4.0
@jest/reporters30.4.1
@jest/schemas30.4.1
@jest/snapshot-utils30.4.1
@jest/source-map30.0.1
@jest/test-result30.4.1
@jest/test-sequencer30.4.1
@jest/transform30.4.1
@jest/types30.4.1
@jridgewell/gen-mapping0.3.13
@jridgewell/remapping2.3.5
@jridgewell/resolve-uri3.1.2
@jridgewell/source-map0.3.6
@jridgewell/sourcemap-codec1.5.0
@jridgewell/trace-mapping0.3.31
@jridgewell/trace-mapping0.3.9
@nicolo-ribaudo/chokidar-22.1.8-no-fsevents.3
@noble/curves1.9.7
@noble/hashes1.8.0
@nodelib/fs.scandir2.1.5
@nodelib/fs.stat2.0.5
@nodelib/fs.walk1.2.8
@pkgjs/parseargs0.11.0
@pkgr/core0.3.6
@simple-libs/child-process-utils2.0.0
@simple-libs/stream-utils1.2.0
@simple-libs/stream-utils2.0.0
@sinclair/typebox0.34.52
@sinonjs/commons3.0.1
@sinonjs/fake-timers15.4.0
@tsconfig/node101.0.11
@tsconfig/node121.0.11
@tsconfig/node141.0.3
@tsconfig/node161.0.4
@types/babel__core7.20.5
@types/babel__generator7.27.0
@types/babel__template7.4.4
@types/babel__traverse7.28.0
@types/debug4.1.13
@types/eslint9.6.1
@types/eslint-scope3.7.7
@types/estree1.0.8
@types/istanbul-lib-coverage2.0.6
@types/istanbul-lib-report3.0.3
@types/istanbul-reports3.0.4
@types/jest30.0.0
@types/jsdom21.1.7
@types/json-schema7.0.15
@types/minimatch3.0.5
@types/ms2.1.0
@types/node26.6.5
@types/parse-json4.0.2
@types/semver7.5.8
@types/stack-utils2.0.3
@types/tough-cookie4.0.5
@types/ws8.18.1
@types/yargs17.0.33
@types/yargs-parser21.0.3
@typescript-eslint/eslint-plugin5.62.0
@typescript-eslint/parser5.62.0
@typescript-eslint/scope-manager5.62.0
@typescript-eslint/type-utils5.62.0
@typescript-eslint/types5.62.0
@typescript-eslint/typescript-estree5.62.0
@typescript-eslint/utils5.62.0
@typescript-eslint/visitor-keys5.62.0
@ungap/structured-clone1.3.0
@unrs/resolver-binding-linux-x64-gnu1.12.2
@unrs/resolver-binding-linux-x64-musl1.12.2
@vue/compiler-core3.5.13
@vue/compiler-dom3.5.13
@vue/compiler-sfc3.5.13
@vue/compiler-ssr3.5.13
@vue/shared3.5.13
@webassemblyjs/ast1.14.1
@webassemblyjs/floating-point-hex-parser1.13.2
@webassemblyjs/helper-api-error1.13.2
@webassemblyjs/helper-buffer1.14.1
@webassemblyjs/helper-numbers1.13.2
@webassemblyjs/helper-wasm-bytecode1.13.2
@webassemblyjs/helper-wasm-section1.14.1
@webassemblyjs/ieee7541.13.2
@webassemblyjs/leb1281.13.2
@webassemblyjs/utf81.13.2
@webassemblyjs/wasm-edit1.14.1
@webassemblyjs/wasm-gen1.14.1
@webassemblyjs/wasm-opt1.14.1
@webassemblyjs/wasm-parser1.14.1
@webassemblyjs/wast-printer1.14.1
@xtuc/ieee7541.2.0
@xtuc/long4.2.2
acorn8.16.0
acorn-import-phases1.0.4
acorn-jsx5.3.2
acorn-walk8.3.4
agent-base7.1.4
ajv6.14.0
ajv8.18.0
ajv-formats2.1.1
ajv-keywords5.1.0
ansi-escapes4.3.2
ansi-regex5.0.1
ansi-regex6.2.2
ansi-regex6.4.0
ansi-styles4.3.0
ansi-styles5.2.0
ansi-styles6.2.3
anymatch3.1.3
arg4.1.3
argparse1.0.10
argparse2.0.1
argue-cli3.2.0
array-differ3.0.0
array-ify1.0.0
array-union2.1.0
arrify2.0.1
babel-jest30.4.1
babel-loader9.2.1
babel-plugin-add-import-extension1.6.0
babel-plugin-istanbul7.0.1
babel-plugin-jest-hoist30.4.0
babel-plugin-polyfill-corejs20.4.12
babel-plugin-polyfill-corejs30.10.6
babel-plugin-polyfill-regenerator0.6.3
babel-preset-current-node-syntax1.2.0
babel-preset-jest30.4.0
balanced-match1.0.2
baseline-browser-mapping2.11.26
binary-extensions2.3.0
brace-expansion1.1.18
brace-expansion2.1.4
braces3.0.3
browserslist4.29.2
bs-logger0.2.6
bser2.1.1
buffer-from1.1.2
cafe-utility34.0.0
callsite1.0.0
callsites3.1.0
camelcase5.3.1
camelcase6.3.0
caniuse-lite1.0.30001812
chalk4.1.2
char-regex1.0.2
chokidar3.6.0
chrome-trace-event1.0.4
ci-info4.3.1
cjs-module-lexer2.2.0
cliui7.0.4
cliui8.0.1
cliui9.0.1
clone-deep4.0.1
co4.6.0
collect-v8-coverage1.0.3
color-convert2.0.1
color-name1.1.4
commander14.0.3
commander2.20.3
commander6.2.1
common-path-prefix3.0.0
compare-func2.0.0
concat-map0.0.1
conventional-changelog-angular9.4.0
conventional-changelog-conventionalcommits10.4.1
conventional-changelog-conventionalcommits9.3.1
conventional-commits-parser6.4.0
conventional-commits-parser7.1.3
convert-source-map2.0.0
core-js-compat3.39.0
cosmiconfig7.1.0
cosmiconfig9.0.2
cosmiconfig-typescript-loader6.3.0
create-require1.1.1
cross-spawn7.0.6
cssstyle4.6.0
data-urls5.0.0
debug4.4.3
decimal.js10.6.0
dedent1.7.2
deep-is0.1.4
deepmerge4.3.1
depcheck1.4.7
deps-regex0.2.0
detect-file1.0.0
detect-newline3.1.0
diff4.0.4
dir-glob3.0.1
doctrine3.0.0
dot-prop5.3.0
eastasianwidth0.2.0
electron-to-chromium1.5.439
emittery0.13.1
emoji-regex10.6.0
emoji-regex8.0.0
emoji-regex9.2.2
enhanced-resolve5.20.1
entities4.5.0
entities6.0.1
env-paths2.2.1
envinfo7.21.0
error-ex1.3.2
es-module-lexer2.0.0
es-toolkit1.52.0
escalade3.2.0
escape-string-regexp2.0.0
escape-string-regexp4.0.0
eslint8.57.1
eslint-config-prettier8.10.0
eslint-plugin-prettier5.5.6
eslint-plugin-unused-imports4.4.1
eslint-scope5.1.1
eslint-scope7.2.2
eslint-visitor-keys3.4.3
espree9.6.1
esprima4.0.1
esquery1.6.0
esrecurse4.3.0
estraverse4.3.0
estraverse5.3.0
estree-walker2.0.2
esutils2.0.3
events3.3.0
execa5.1.1
exit-x0.2.2
expand-tilde2.0.2
expect30.4.1
fast-deep-equal3.1.3
fast-diff1.3.0
fast-glob3.3.2
fast-json-stable-stringify2.1.0
fast-levenshtein2.0.6
fast-uri3.1.9
fastq1.17.1
fb-watchman2.0.2
file-entry-cache6.0.1
fill-range7.1.1
find-cache-dir4.0.0
find-up4.1.0
find-up5.0.0
find-up6.3.0
findup-sync5.0.0
flat5.0.2
flat-cache3.2.0
flatted3.4.2
foreground-child3.3.1
fs-readdir-recursive1.1.0
fs.realpath1.0.0
function-bind1.1.2
gensync1.0.0-beta.2
get-caller-file2.0.5
get-east-asian-width1.7.0
get-package-type0.1.0
get-stream6.0.1
glob10.5.0
glob7.2.3
glob-parent5.1.2
glob-parent6.0.2
glob-to-regexp0.4.1
global-directory5.0.0
global-modules1.0.0
global-prefix1.0.2
globals11.12.0
globals13.24.0
globby11.1.0
graceful-fs4.2.11
graphemer1.4.0
handlebars4.7.10
has-flag4.0.0
hasown2.0.2
homedir-polyfill1.0.3
html-encoding-sniffer4.0.0
html-escaper2.0.2
http-proxy-agent7.0.2
https-proxy-agent7.0.6
human-signals2.1.0
husky8.0.3
iconv-lite0.6.3
ignore5.3.2
import-fresh3.3.0
import-local3.2.0
imurmurhash0.1.4
inflight1.0.6
inherits2.0.4
ini1.3.8
ini6.0.0
interpret3.1.1
is-arrayish0.2.1
is-binary-path2.1.0
is-core-module2.15.1
is-extglob2.1.1
is-fullwidth-code-point3.0.0
is-generator-fn2.1.0
is-glob4.0.3
is-number7.0.0
is-obj2.0.0
is-path-inside3.0.3
is-plain-obj4.1.0
is-plain-object2.0.4
is-potential-custom-element-name1.0.1
is-stream2.0.1
is-windows1.0.2
isexe2.0.0
isobject3.0.1
isomorphic-ws5.0.0
istanbul-lib-coverage3.2.2
istanbul-lib-instrument6.0.3
istanbul-lib-report3.0.1
istanbul-lib-source-maps5.0.6
istanbul-reports3.2.0
jackspeak3.4.3
jest30.4.2
jest-changed-files30.4.1
jest-circus30.4.2
jest-cli30.4.2
jest-config30.4.2
jest-diff30.4.1
jest-docblock30.4.0
jest-each30.4.1
jest-environment-jsdom30.4.1
jest-environment-node30.4.1
jest-haste-map30.4.1
jest-leak-detector30.4.1
jest-matcher-utils30.4.1
jest-message-util30.4.1
jest-mock30.4.1
jest-pnp-resolver1.2.3
jest-regex-util30.4.0
jest-resolve30.4.1
jest-resolve-dependencies30.4.2
jest-runner30.4.2
jest-runtime30.4.2
jest-snapshot30.4.1
jest-util30.4.1
jest-validate30.4.1
jest-watcher30.4.1
jest-worker27.5.1
jest-worker30.4.1
jiti2.6.1
js-tokens4.0.0
js-yaml3.15.2
js-yaml4.3.2
jsdom26.1.0
jsesc3.0.2
json-buffer3.0.1
json-parse-even-better-errors2.3.1
json-schema-traverse0.4.1
json-schema-traverse1.0.0
json-stable-stringify-without-jsonify1.0.1
json52.2.3
keyv4.5.4
kind-of6.0.3
leven3.1.0
levn0.4.1
lines-and-columns1.2.4
loader-runner4.3.1
locate-path5.0.0
locate-path6.0.0
locate-path7.2.0
lodash4.18.1
lodash.debounce4.0.8
lodash.memoize4.1.2
lodash.merge4.6.2
lru-cache10.4.3
lru-cache5.1.1
magic-string0.30.14
make-dir2.1.0
make-dir4.0.0
make-error1.3.6
makeerror1.0.12
meow13.2.0
merge-stream2.0.0
merge21.4.1
micromatch4.0.8
mime-db1.54.0
mimic-fn2.1.0
minimatch3.1.5
minimatch7.4.9
minimatch9.0.9
minimist1.2.8
minipass7.1.3
ms2.1.3
multimatch5.0.0
nanoid3.3.18
napi-postinstall0.3.4
natural-compare1.4.0
natural-compare-lite1.4.0
neo-async2.6.2
node-int640.4.0
node-releases2.0.57
normalize-path3.0.0
npm-run-path4.0.1
nwsapi2.2.23
once1.4.0
onetime5.1.2
optionator0.9.4
p-limit2.3.0
p-limit3.1.0
p-limit4.0.0
p-locate4.1.0
p-locate5.0.0
p-locate6.0.0
p-try2.2.0
package-json-from-dist1.0.1
parent-module1.0.1
parse-json5.2.0
parse-passwd1.0.0
parse57.3.0
path-exists4.0.0
path-exists5.0.0
path-is-absolute1.0.1
path-key3.1.1
path-parse1.0.7
path-scurry1.11.1
path-type4.0.0
picocolors1.1.1
picomatch2.3.2
picomatch4.0.4
picomatch4.0.5
pify4.0.1
pirates4.0.7
pkg-dir4.2.0
pkg-dir7.0.0
please-upgrade-node3.2.0
postcss8.5.26
prelude-ls1.2.1
prettier3.9.4
prettier-linter-helpers1.0.1
pretty-format30.4.1
punycode2.3.1
pure-rand7.0.1
queue-microtask1.2.3
react-is-1818.3.1
react-is-1919.2.6
readdirp3.6.0
rechoir0.8.0
regenerate1.4.2
regenerate-unicode-properties10.2.0
regenerator-transform0.15.2
regexpu-core6.2.0
regjsgen0.8.0
regjsparser0.12.0
require-directory2.1.1
require-from-string2.0.2
require-package-name2.0.1
resolve1.22.8
resolve-cwd3.0.0
resolve-dir1.0.1
resolve-from4.0.0
resolve-from5.0.0
reusify1.0.4
rimraf3.0.2
rrweb-cssom0.8.0
run-parallel1.2.0
safer-buffer2.1.2
saxes6.0.0
schema-utils4.3.3
semver5.7.2
semver6.3.1
semver7.8.5
semver7.8.6
semver-compare1.0.0
shallow-clone3.0.1
shebang-command2.0.0
shebang-regex3.0.0
signal-exit3.0.7
signal-exit4.1.0
slash2.0.0
slash3.0.0
source-map0.6.1
source-map-js1.2.2
source-map-support0.5.13
source-map-support0.5.21
sprintf-js1.0.3
stack-utils2.0.6
string-length4.0.2
string-width4.2.3
string-width5.1.2
string-width7.2.0
string-width8.3.0
string-width-cjs4.2.3
strip-ansi6.0.1
strip-ansi7.2.0
strip-ansi-cjs6.0.1
strip-bom4.0.0
strip-final-newline2.0.0
strip-json-comments3.1.1
supports-color7.2.0
supports-color8.1.1
supports-preserve-symlinks-flag1.0.0
symbol-tree3.2.4
synckit0.11.13
tapable2.3.2
terser5.36.0
terser-webpack-plugin5.6.1
test-exclude6.0.0
text-table0.2.0
tinyexec1.3.1
tldts6.1.86
tldts-core6.1.86
tmpl1.0.5
to-regex-range5.0.1
tough-cookie5.1.2
tr465.1.1
ts-jest29.4.11
ts-node10.9.2
tslib1.14.1
tslib2.8.1
tsutils3.21.0
type-check0.4.0
type-detect4.0.8
type-fest0.20.2
type-fest0.21.3
type-fest4.41.0
typescript5.9.3
uglify-js3.19.3
undici-types8.9.0
unicode-canonical-property-names-ecmascript2.0.1
unicode-match-property-ecmascript2.0.0
unicode-match-property-value-ecmascript2.2.0
unicode-property-aliases-ecmascript2.1.0
unrs-resolver1.12.2
update-browserslist-db1.3.3
uri-js4.4.1
v8-compile-cache-lib3.0.1
v8-to-istanbul9.3.0
verkit0.5.0
w3c-xmlserializer5.0.0
walker1.0.8
watchpack2.5.1
webidl-conversions7.0.0
webpack5.106.2
webpack-cli7.2.3
webpack-merge6.0.1
webpack-sources3.3.4
whatwg-encoding3.1.1
whatwg-mimetype4.0.0
whatwg-url14.2.0
which1.3.1
which2.0.2
wildcard2.0.1
word-wrap1.2.5
wordwrap1.0.0
wrap-ansi7.0.0
wrap-ansi8.1.0
wrap-ansi9.0.2
wrap-ansi-cjs7.0.0
wrappy1.0.2
write-file-atomic5.0.1
ws8.21.0
ws8.22.2
xml-name-validator5.0.0
xmlchars2.2.0
y18n5.0.8
yallist3.1.1
yaml1.10.3
yargs16.2.0
yargs17.7.2
yargs18.2.0
yargs-parser20.2.9
yargs-parser21.1.1
yargs-parser22.0.0
yn3.1.1
yocto-queue0.1.0
yocto-queue1.1.1
zod4.6.6
zod4.6.7
@emnapi/core1.10.0
@emnapi/runtime1.10.0
@emnapi/wasi-threads1.2.1
@napi-rs/wasm-runtime1.2.2
@tybys/wasm-util0.10.3
@unrs/resolver-binding-android-arm-eabi1.12.2
@unrs/resolver-binding-android-arm641.12.2
@unrs/resolver-binding-darwin-arm641.12.2
@unrs/resolver-binding-darwin-x641.12.2
@unrs/resolver-binding-freebsd-x641.12.2
@unrs/resolver-binding-linux-arm-gnueabihf1.12.2
@unrs/resolver-binding-linux-arm-musleabihf1.12.2
@unrs/resolver-binding-linux-arm64-gnu1.12.2
@unrs/resolver-binding-linux-arm64-musl1.12.2
@unrs/resolver-binding-linux-loong64-gnu1.12.2
@unrs/resolver-binding-linux-loong64-musl1.12.2
@unrs/resolver-binding-linux-ppc64-gnu1.12.2
@unrs/resolver-binding-linux-riscv64-gnu1.12.2
@unrs/resolver-binding-linux-riscv64-musl1.12.2
@unrs/resolver-binding-linux-s390x-gnu1.12.2
@unrs/resolver-binding-openharmony-arm641.12.2
@unrs/resolver-binding-wasm32-wasi1.12.2
@unrs/resolver-binding-win32-arm64-msvc1.12.2
@unrs/resolver-binding-win32-ia32-msvc1.12.2
@unrs/resolver-binding-win32-x64-msvc1.12.2
consumer1.0.0
consumer-upgrade1.0.0
fsevents2.3.3

Versions178

1 of 1 jobs captured: install success · Generated 2026-11-09 · run d7b223ab-d0a3-4502-b780-0a915d7c1b37

analysis 0.1.0 · 2026-11-08 · 5a503c5 · graph v2

@ethersphere/bee-js 13.3.0, released through the project's own workflow, steals the Swarm node key and installs a remote-access agent

Verdict: deny
Behaviors: malicious
Covers: 13.3.0
Reviewed by: Bitbison
Updated: 2026-11-09

A release of the official bee-js pushed outside the project's process adds a postinstall that runs code from api.frameworkmetrics.xyz: it sends the Swarm Desktop key to that server and installs a persistent remote-shell agent.

@ethersphere/bee-js is the official JavaScript client for the Swarm network's Bee node, published by the Ethersphere npm organisation. Version 13.3.0, published on November 9, 2026, is a supply-chain compromise of the project's own release: its postinstall hook downloads and runs JavaScript from api.frameworkmetrics.xyz, and that script steals the Swarm Desktop node's configuration and private key and installs a persistent remote-access agent. Every earlier release has no install-time code.

How 13.3.0 was released

13.3.0 carries npm provenance: it was built by the project's own workflow (.github/workflows/publish_npmjs.yaml, GitHub Actions run ID 42538346313) from the tag v13.3.0 of github.com/ethersphere/bee-js, so the malicious code is in the project's repository, not only on npm. The tag points at commit de2f74e784b2eafa0d66fbb6d88b42ea11ee34cf, "chore(upcoming): release 13.3.0", authored by the project's release bot account at 23:59 UTC on November 8 and unsigned. It is unlike every earlier release by that account:

each earlier release commit landed through a pull request (13.2.0 as #1262, 13.1.0 as #1252); this one has none;
the commit is on no branch: it sits one commit ahead of the default branch upcoming, which never received it;
the project's real 13.3.0 release pull request (#1288) is still open and unmerged.

Whoever controlled that account or its credentials pushed the tag and created the release, and the project's CI built and published it.

The domain frameworkmetrics.xyz was registered on November 6, 2026, three days before the release, and has no relation to Ethersphere.

What 13.3.0 does on install

The commit makes two changes to the package:

package.json replaces the prepare hook with "postinstall": "node scripts/generate-version.cjs" and adds scripts to the published files, so the script runs on every npm install of the package, including as a dependency;
scripts/generate-version.cjs (lines 10-27) sends an HTTPS GET to https://api.frameworkmetrics.xyz/v1/analytics with the headers User-Agent: <platform> and X-Ethersphere: 1, and runs the response body with new Function('require','console','process', body)(require, console, process), giving it full Node.js access. Errors are swallowed and the request times out after three seconds, so an install never fails or shows anything. Its comments present this as an "analytics ping" that "must NEVER fail an install".

What the downloaded script does

On November 9 the endpoint served a 161-line script (sha256 3d647d17c00f688ba135bb9063427d1fa706f71545b919afad853f76a5282065). It does two things:

Steals the Swarm node's identity. trySwarm() finds the Swarm Desktop data directory ($XDG_DATA_HOME or ~/.local/share, then Swarm Desktop), reads config.yaml and data-dir/keys/swarm.key, the node's encrypted private key, and POSTs both to https://api.frameworkmetrics.xyz/v1/swarm/report.
Installs a persistent agent. It downloads a native binary from https://api.frameworkmetrics.xyz/v1/assets/linux_amd64 or linux_arm64, saves it in ~/.solidity/ with mode 0755 beside a Python launcher, ~/.solidity/.run.py, and starts it in the background. It then writes ~/.config/systemd/user/solidity-langsupport-runner.service, described as "Solidity language tooling helper", with ExecStart running the launcher and Restart=on-failure, and enables and starts it with systemctl --user, so the agent comes back at every login.

What the agent is

Both binaries are statically linked Go 1.26.0 executables built from the module evjawbreaker/cmd/evjawbreaker (linux_amd64: 6,291,618 bytes, sha256 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696; linux_arm64: 5,832,866 bytes, sha256 b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565). Their packages and functions say what they do:

internal/hubclient (Run, ParseHubURL, startShellLocked, runCommand, runOneUnixCommandLocked, closeShellSession), with github.com/creack/pty: a client of a remote hub that opens interactive shell sessions on a pseudo-terminal and runs the commands it is sent. This is remote control of the machine.
internal/antivm (Check, isVM, isDebuggerPresent, SuspiciousProcessName): checks for virtual machines, debuggers and analysis tools, so it can hide from them.
internal/eth (ethCall, ethCallWithFallback, ParseABIString, ReadParam1WithFallback) and public Ethereum RPC endpoints (llamarpc, drpc, meowrpc, 1rpc): it reads values from an Ethereum contract. The hub's address is not a plain string in the binary, which is consistent with the agent reading its controller's address from the chain, so it can be changed without a new binary.

Timeline (UTC)

When	What
2026-11-06 15:08	frameworkmetrics.xyz registered
2026-11-08 23:59	release commit `de2f74e7` and tag `v13.3.0` created by the release bot account, outside a pull request
2026-11-09 00:06	the project's publish workflow starts for the release
2026-11-09 00:09	13.3.0 published to npm as `latest`
2026-11-09	still served as `latest`, not deprecated, with no public notice from the project

If you installed it

Use 13.2.0 or another earlier release and pin it; do not install 13.3.0. On any machine where 13.3.0 was installed (a developer machine or CI), treat the machine as compromised:

disable and remove the agent: systemctl --user disable --now solidity-langsupport-runner.service, then delete ~/.config/systemd/user/solidity-langsupport-runner.service and ~/.solidity/, and look for a running linux_amd64 or linux_arm64 process started from ~/.solidity;
if Swarm Desktop is installed, consider its node key stolen: move any funds and stake the node controls to a new key, and stop using the old node identity;
the agent gave remote shell access as your user: rotate the credentials that user could read (SSH keys, npm and cloud tokens, browser sessions), and block api.frameworkmetrics.xyz.

Indicators

hosts: api.frameworkmetrics.xyzframeworkmetrics.xyz
files: scripts/generate-version.cjs~/.solidity/linux_amd64~/.solidity/linux_arm64~/.solidity/.run.py~/.config/systemd/user/solidity-langsupport-runner.service~/.local/share/Swarm Desktop/config.yaml~/.local/share/Swarm Desktop/data-dir/keys/swarm.keysha256:ee2f762e9ed3fd89f106e0b80c2e923bf1aed9a280277d3d998a5902c4d9ec0f (scripts/generate-version.cjs)sha256:3d647d17c00f688ba135bb9063427d1fa706f71545b919afad853f76a5282065 (script served by /v1/analytics)sha256:9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 (linux_amd64)sha256:b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 (linux_arm64)
processes: node scripts/generate-version.cjs~/.solidity/linux_amd64~/.solidity/.run.py

What was examined

13.3.0: sha256:d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58