Attackers Used Ethersphere's Release Automation to Publish bee-js 13.3.0 and Swarm Desktop 0.56.2, Which Fetch Code Built to Steal Swarm Wallet Keys

Overview

Attackers used Ethersphere’s own release automation on November 9, 2026 to publish malicious versions of two tools for the Swarm decentralized storage network, bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 on GitHub, according to The Hacker News. The outlet reports that both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it, and to install a backdoor on Windows, macOS and Linux machines. The Swarm Desktop maintainers wrote that 0.56.2 “was published by an attacker using stolen CI credentials and has been withdrawn”. GitHub’s advisory database lists @ethersphere/bee-js 13.3.0 as malware, with no patched version.

All times are UTC. The Hacker News is the only news outlet among the cited sources; its article draws on analyses by Socket and SafeDep, both supply chain security firms.

What We Know

Timeline, in chronological order.

• November 8, 23:30:47: Socket says the Ethereum smart contract that tells the backdoor where to connect was updated, 29 minutes before the malicious bee-js commit. The Hacker News gives the same 29-minute gap.
• November 9, 00:09:50: Socket says npm received bee-js 13.3.0 under the latest tag, after a GitHub release for the v13.3.0 tag at 00:06:01. The Hacker News puts the time it was the latest version at about 75 minutes, from 00:09 to 01:25.
• About 00:36: Swarm Desktop 0.56.2 appeared on GitHub, per The Hacker News, which adds that, according to Socket, the app’s built-in updater could offer it to Windows x64 computers and Apple Silicon Macs within about 10 minutes. Intel Macs were never offered it, and Linux installs do not update automatically.
• 01:24:58: Socket says npm removed 13.3.0; it says GitHub issued advisory GHSA-hh7j-5m3j-23pf at 01:25:27.
• 09:04: Socket says the maintainers deleted the v0.56.2 tag, and that the release was no longer public by about 09:14.
• 12:52: the v0.56.3 release was published with the note “replace compromised 0.56.2 release”. The maintainers’ pull request says it is the v0.56.1 code with no changes and that, because 0.56.3 is a higher version, the auto-updater will move installs of the malicious build to it. The Hacker News says its own comparison of the two versions’ source code found no changes beyond the version number and release notes.

How the releases got out. According to The Hacker News, neither malicious change was signed or submitted as a pull request, and both came from bee-worker, the account Ethersphere uses to automate releases. For bee-js, the attackers published a GitHub release, which started the npm publishing workflow; the outlet says that workflow needed no approval and published the package in 73 seconds, according to Socket. The package carried valid provenance because the project’s own workflow built it; The Hacker News writes that provenance shows “where a package was built, not whether anyone reviewed the code inside it”. For Swarm Desktop, the attackers manually started a build workflow that held the project’s signing certificates and needed no approval, so the macOS app was signed with the project’s Developer ID and notarized by Apple, per The Hacker News. The outlet says the maintainers have since made the signing jobs wait for approval from the project’s DevOps team.

What the code does. Per The Hacker News, citing SafeDep, both releases carry the same few-line loader that downloads code from api.frameworkmetrics[.]xyz and runs it with the user’s permissions: in bee-js as the postinstall script, in Swarm Desktop each time the app starts. A project did not need to import the library for the code to run. The downloaded code looks for config.yaml and data-dir/keys/swarm.key in Swarm Desktop’s data folder and, if both are present, sends them to the attackers’ server. Swarm Desktop keeps the keystore password in plain text in config.yaml, so, SafeDep says as relayed by the outlet, the attackers could take the node wallet’s xDAI and xBZZ tokens, chequebook funds and stake. On Linux and macOS the backdoor is a Go remote shell called evjawbreaker; on Windows the code installs a genuine ScreenConnect remote-access client signed by ConnectWise.

CI exposure. Socket says the loader ran three times inside the npm publishing job and that the attacker’s server answered the project’s build runner. It adds that public data cannot show whether the served code read the runner’s environment or requested an OIDC token.

Who may be affected. The Hacker News says the project’s own swarm-cli and bee-dashboard packages, and the Swarm Desktop source code, accepted version ranges that included 13.3.0. Socket says npm 11 and earlier, Yarn Classic and Yarn Berry before 4.14.0 run dependency postinstall scripts by default, while npm 12, pnpm 10 and later and Yarn Berry 4.14.0 and later, among others, skip unreviewed dependency scripts by default. Socket estimates on the order of ten fetches of bee-js 13.3.0, including scanners and mirrors, and says the Swarm Desktop 0.56.2 download counters reached 65 by 08:27, including researchers. The Hacker News says none of the reports gave a count of infected machines and that no theft of funds had been reported at the time of writing.

Guidance. GitHub’s advisory says: “Any computer that has this package installed or running should be considered fully compromised.” The Hacker News lists these steps: search lockfiles, caches, internal registries and CI install logs for @ethersphere/[email protected] and pin 13.2.0; treat a machine or runner that installed 13.3.0 with install scripts on as compromised even if the install log shows no errors; and for Swarm Desktop, look for the line “Bee Desktop version: 0.56.2 (production)” in bee-desktop.log, install 0.56.3, and treat the node’s key and password as stolen if 0.56.2 ever ran. It adds that updating or removing the app or package does not remove a backdoor already installed.

Earlier campaign. The Hacker News says the payloads share an Ethereum contract, a ScreenConnect relay and file names with fake Solidity-developer extensions that appeared on the Open VSX marketplace in September, and that Socket says the same group is behind these releases. Pluto Security wrote that it assessed with high confidence that the September campaign was the same actor behind the earlier SleepyDuck and ScreenConnect campaigns.

What We Don’t Know

• How the credentials were stolen. The Hacker News says access remained unclear and that the maintainer’s incident note blames the theft of CI credentials and secrets. Socket says two GitHub accounts were compromised, the release bot and a maintainer’s, and that the origin of both remains unexplained.
• Impact. The Hacker News reported no theft of funds as of its November 9 article, and the download figures above are Socket’s estimates and counters, not counts of infections.
• Independent confirmation. The payload analysis comes from Socket and SafeDep through The Hacker News; the cited sources include no second news outlet.