Attackers hijack Ethersphere release pipeline to push trojanized bee-js and Swarm Desktop

Attackers used Ethersphere’s own bee-worker release automation account on Nov. 9, 2026 to publish trojanized bee-js 13.3.0 to npm and Swarm Desktop 0.56.2 to GitHub, turning the Swarm decentralized storage network’s trusted publishing pipeline into an initial-access vector.

The malicious code steals the Swarm Desktop node wallet key and the stored password that unlocks it, then installs a backdoor on Windows, macOS and Linux machines. The downloaded code looks for config.yaml and data-dir/keys/swarm.key in Swarm Desktop’s data folder and sends both to the attackers’ server if present. The keystore file uses Ethereum encryption while Swarm Desktop saves its password in clear text in config.yaml, and attackers can take the node wallet’s xDAI and xBZZ tokens, chequebook funds and stake with both files.

Attackers did not sign the changes or submit a pull request. Instead, they created a GitHub release for bee-js 13.3.0, triggering the project’s npm publishing workflow, which pushed the package to the registry in 73 seconds, according to Socket, a supply chain security firm. The package carried valid provenance because the project’s genuine workflow produced it, though provenance reveals only a build location, not whether code received review. The bee-js package executes a postinstall script automatically during npm installation unless a project turns off install scripts, and a project did not need to import the library for the malicious code to run.

bee-js 13.3.0 remained the latest npm release for about 75 minutes, running from 00:09 to 01:25 UTC on Nov. 9, 2026, before removal. The JavaScript library sits behind Swarm Desktop and the swarm-cli command-line tool. Socket’s rough estimate puts downloads at about 10, counting security scanners and mirrors. The project’s swarm-cli and bee-dashboard packages, along with Swarm Desktop source code, allowed version ranges containing 13.3.0, exposing transitive dependencies even to projects that never directly imported bee-js.

Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC on Nov. 9, 2026 and was withdrawn about 8.5 hours later. Swarm Desktop runs a Swarm node on a user’s computer and saves the node’s private keys there. The app’s built-in updater could offer it to Windows x64 computers and Apple Silicon Macs within about 10 minutes, according to Socket, though Intel Macs were never offered the version and Linux installs do not update automatically. By 08:27 UTC that day, the malicious desktop release had seen 65 downloads, including by researchers.

The Swarm Desktop malicious app followed the npm package at roughly 00:36 UTC, about 27 minutes later, according to Crypto Briefing. Both malicious releases were taken down on Nov. 9, 2026.

Any machine running or installing bee-js 13.3.0 must be treated as completely compromised, according to GitHub advisory GHSA-hh7j-5m3j-23pf cited in the reporting. SafeDep, a software supply chain security company, says any computer on which Swarm Desktop 0.56.2 was installed should be considered fully compromised. The reports did not provide a number of compromised machines.

The intrusion relied on infrastructure connected to the earlier SleepyDuck malware campaign. The malicious packages use a single Ethereum contract, a ScreenConnect relay and filenames pretending to be Solidity extensions that surfaced on the Open VSX marketplace in September. Pluto attributes the activity to the group responsible for the first SleepyDuck extension with high confidence, while Socket attributes both the bee-js and Swarm Desktop releases to the same group. Researchers at Pluto Security described Open VSX extensions in their Oct. 1 EtherDuck analysis and tie the activity to the group behind the original SleepyDuck extension, which pulled its server address from another Ethereum contract in 2025.

The method the attackers used to gain access remained unknown at the time of writing. A maintainer said the withdrawn 0.56.2 release came from an attacker using stolen CI credentials, and the maintainer’s incident note attributes the breach to stolen CI credentials and secrets. Socket says the intruders used two GitHub accounts: bee-worker and another account held by a longtime maintainer. No report described the method used to steal the credentials.

Ethersphere’s maintainers released a clean Swarm Desktop update, version 0.56.3, on Nov. 9, 2026. Per the maintainer’s incident note, 0.56.3 contains the same code as 0.56.1 and was signed with a newly issued Developer ID certificate. On Nov. 9, 2026, The Hacker News found that bee-js 13.2.0 was once more the latest release on npm, while 13.3.0 had been removed from the registry.

Swarm Desktop 0.56.2 installations will be updated to 0.56.3 by the app’s auto-updater, but Linux packages must be swapped manually. At the time of writing, no fund theft had been reported. Removing the malicious releases does not remove a backdoor already installed or protect a key already sent, and upgrading to a clean version does not suffice because exposed keys remain exposed and backdoors persist until removed.

Apple notarized the malicious macOS application, and it carried the project’s Developer ID, so the operating system showed only the usual first-run alert. A manual trigger launched the Swarm Desktop build process, which held the project’s Apple and Windows code-signing certificates, requiring no sign-off. The maintainers have since configured signing jobs to require DevOps team approval and to execute only from the main branch.

On Discord, Ethereum Swarm told users to secure their systems and replace the compromised desktop release, according to Crypto Briefing. Affected users should look in lockfiles, package caches, internal registries and CI installation logs for @ethersphere/bee-js@13.3.0, then pin bee-js version 13.2.0 and clear cached copies of 13.3.0. Treat a machine or CI runner as compromised if it has bee-js 13.3.0 installed with install scripts enabled, even when the installation log contains no errors. Using a clean computer, users should change every password, token and key accessible to the installing user or CI job.

If Swarm Desktop 0.56.2 ever ran, the node’s key and password should be treated as stolen, and funds should be moved to a new key from a clean computer. On any machine where the code ran, users should remove the ~/.solidity/ folder and related backdoor services on Linux, macOS and Windows. Backdoor components remain even after the app or package is updated, reinstalled or removed, so when possible users should rebuild the machine from a trusted image rather than cleaning it in place.