Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor on Windows, macOS, and Linux machines.

The bee-js package is the JavaScript library behind Swarm Desktop and the swarm-cli command-line tool. Swarm Desktop runs a Swarm node on a user's own computer and saves the node's private keys there.

Both malicious releases have been taken down, and the project's maintainers released a clean Swarm Desktop update today. Neither step removes a backdoor already installed nor protects a key already sent. No theft of funds had been reported at the time of writing.

Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC today and was withdrawn about 8.5 hours later. The app's built-in updater could offer it to Windows x64 computers and Apple Silicon Macs within about 10 minutes, according to an incident analysis by Socket, a supply chain security firm. Intel Macs were never offered it, and Linux installs do not update automatically.

The bee-js release, version 13.3.0, was the latest version on npm for about 75 minutes, from 00:09 to 01:25 UTC today. Its code runs as a postinstall script, which npm executes automatically during installation unless install scripts are disabled. A project did not need to import the library for the code to run.

The project's own swarm-cli and bee-dashboard packages, and the Swarm Desktop source code, accepted version ranges that included 13.3.0. A fresh install within that window could have pulled in the malicious version.

None of the reports gave a count of infected machines. The firm's rough estimate is that bee-js 13.3.0 was downloaded about 10 times, including by security scanners and mirrors. Swarm Desktop 0.56.2's download count reached 65 by 08:27 UTC, including researchers.

Ethersphere's maintainers withdrew 0.56.2 and replaced it today with a clean release, version 0.56.3. In the change that set up the new release, one of them wrote that 0.56.2 "was published by an attacker using stolen CI credentials and has been withdrawn."

Version 0.56.3 is the same code as the previous version, 0.56.1, signed with a newly issued Developer ID certificate, according to that maintainer's incident note. The note says the app's auto-updater will move installs of 0.56.2 to it, although Linux packages still need to be replaced by hand.

A comparison of the two versions' source code by The Hacker News found no changes beyond the version number and release notes. When The Hacker News checked npm today, 13.2.0 was again the latest bee-js version, and 13.3.0 could no longer be downloaded from the registry.

What to Do

The GitHub advisory for bee-js 13.3.0 says: "Any computer that has this package installed or running should be considered fully compromised." SafeDep, a software supply chain security company, offers the same advice for any computer on which Swarm Desktop 0.56.2 was installed.

If you use bee-js in a project or CI job:

• Search lockfiles, package caches, internal registries, and CI install logs for @ethersphere/bee-js@13.3.0, including copies pulled in by other packages.
• Pin 13.2.0, and clear cached copies of 13.3.0, including any npm mirror you install through.
• If 13.3.0 was installed with install scripts turned on, treat that machine or CI runner as compromised, even if the install log shows no errors. The code hides its own network errors.
• From a clean computer, rotate every password, token, and key that the installing user or CI job could read.

If you run Swarm Desktop:

• Look for the line Bee Desktop version: 0.56.2 (production) in the app's log file, bee-desktop.log. Version 0.56.2 is written at every launch, just before the malicious code runs.
• The log folder is ~/Library/Logs/Swarm Desktop/ on macOS, %LOCALAPPDATA%\Swarm Desktop\Log\ on Windows, and ~/.local/state/Swarm Desktop/ on Linux.
• Install 0.56.3. On Linux, replace the package by hand.
• If 0.56.2 ever ran, treat the node's key and password as stolen. From a clean computer, move the node's funds, chequebook, and stake to a new key.

On any machine where the code ran:

• Remove the ~/.solidity/ folder, the solidity-langsupport-runner.service user service on Linux, the com.solidity.langsupport.runner LaunchAgent on macOS, and the ScreenConnect Client (5cbe79c9c25524df) service on Windows.
• Updating, reinstalling, or removing the app or package does not remove them.
• Where possible, rebuild the machine from a trusted image instead of cleaning it in place.

How the Malware Works

Both releases carry the same loader, SafeDep found in its technical analysis. It is a few lines of code that download more code from api.frameworkmetrics[.]xyz and run it with the user's permissions. In bee-js the loader is the postinstall script, and in Swarm Desktop it runs each time the app starts.

The downloaded code looks for two files in Swarm Desktop's data folder: config.yaml and data-dir/keys/swarm.key. If both are there, it sends them to the attackers' server. The key file is an encrypted Ethereum keystore, but Swarm Desktop keeps its password in plain text in config.yaml. With both files, the attackers can take the node wallet's xDAI and xBZZ tokens, its chequebook funds, and its stake, the company says.

The downloaded code also installs a backdoor. On Linux and macOS, it is a Go remote shell called evjawbreaker, saved in a hidden ~/.solidity folder. It runs in the background as a user service on Linux and as a LaunchAgent on macOS. The shell reads the address of its control server from an Ethereum smart contract, so the attackers can change that address at any time. They had updated it 29 minutes before the malicious bee-js code was added.

On Windows, the downloaded code installs a genuine ScreenConnect remote-access client, signed by its maker, ConnectWise. The client runs as a system service and connects to the attackers' relay. If the user is an administrator, the code gets administrator rights through a known way around the User Account Control prompt. If not, it shows the prompt again whenever the user cancels. With those rights, it adds a Microsoft Defender exclusion and installs the client silently.

How the Releases Got Out

Both releases came from bee-worker, the account Ethersphere uses to automate its releases. Neither change was signed nor submitted as a pull request.

For bee-js, the attackers published a GitHub release for the new version, which started the project's npm publishing workflow. That workflow needed no approval and published the package to npm in 73 seconds, according to Socket. Because the project's real workflow built it, the package carried valid provenance, the record that links an npm package to the repository and workflow that built it. Provenance shows where a package was built, not whether anyone reviewed the code inside it.

For Swarm Desktop, the attackers manually started a build workflow that had the project's Apple and Windows signing certificates and needed no approval. The macOS app was signed with the project's Developer ID and notarized by Apple, so macOS displayed only its normal first-launch prompt, the firm found. The maintainers have since made the app's signing jobs wait for approval from the project's DevOps team and run only from the main branch.

How the attackers gained access remained unclear at the time of writing. The maintainer's incident note blames the theft of CI credentials and secrets. The firm's analysis indicates that two GitHub accounts were used: bee-worker and a long-time maintainer's account. None of the reports explained how the credentials were stolen.

Links to Earlier Attacks

The payloads share an Ethereum contract, a ScreenConnect relay, and file names with fake extensions for Solidity developers that appeared on the Open VSX marketplace in September. Researchers at Pluto Security described those extensions in their October 1 EtherDuck analysis. Pluto ties them "with high confidence" to the group behind the original SleepyDuck extension, which read its server address from a different Ethereum contract in 2025. Socket says the same group is behind the bee-js and Swarm Desktop releases.

Indicators of Compromise

Defenders can search logs and machines for the following.

• Domain: api.frameworkmetrics[.]xyz
• URL path: /v1/analytics (bee-js loader)
• URL path: /v1/electron (Swarm Desktop loader)
• URL path: /v1/assets/ (further payloads)
• URL path: /v1/swarm/report (stolen wallet files)
• HTTP header: X-Ethersphere: 1
• IP:port: 193[.]57[.]9[.]155:4912 (evjawbreaker control server)
• IP:port: 185[.]232[.]84[.]169:8041 (ScreenConnect relay)
• Ethereum contract: 0xf8a900Db50b3331be6B768bA460BB59f3E40C344
• Path: ~/.solidity/
• systemd unit: solidity-langsupport-runner.service
• LaunchAgent: com.solidity.langsupport.runner
• Service: ScreenConnect Client (5cbe79c9c25524df)
• SHA-256: 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 (linux_amd64)
• SHA-256: b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 (linux_arm64)
• SHA-256: 80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f (darwin_amd64)
• SHA-256: fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358 (darwin_arm64)
• SHA-256: 37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e (invoke.ps1)
• SHA-256: 7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da (app.msi)