Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH049

How far did the compromised bee-js 13.3.0 travel, in fetches from npm, on 9 November 2026 and after?

In short. Just after midnight UTC on 9 November 2026 a release of bee-js, a JavaScript library for the Swarm storage network, was published to npm through the project's own release workflow, with a genuine provenance signature, and with code that ran at install time and fetched more code from an attacker's server, as StepSecurity and Socket report. npm removed it about 75 minutes later. We'll count how often npm's public download figures record it being fetched that day and afterwards, using a per-version count npm keeps for only seven days, so the reads have to start now. Socket has guessed "on the order of ten" fetches; we have read that guess but no download figure from npm. A download is a fetch, not an install or a victim. Reads daily from 10 November, the last on 24 November; the record by 1 December.

No write-up yet studies/LH049/brief.md

From studies/LH049/ in the repository, last changed 10 November 2026.