Provenance Record

News, 1128 body words (400-1200 range). Clear structure: Overview, What We Know (chronological timeline plus mechanism, payload, exposure, guidance, earlier campaign), What We Don't Know. Attribution is consistent (The Hacker News, Socket, SafeDep-via-THN, GitHub advisory, maintainers' PR). Bun/Deno in Socket's package-manager list are covered by 'among others'. No relative dates (all dates are calendar dates; 'All times are UTC' stated). No individual is blamed beyond the sources: account handles (bee-worker is the project's release bot, named by THN) and no maintainer is named. No duplicate: no existing article on bee-js, Swarm Desktop, Ethersphere, SleepyDuck or EtherDuck in src/content/articles.

Snapshots read from sources/2026-11/attackers-used-etherspheres-release-automation-to-publish-bee-js-1330-and-swarm-desktop-0562-which-fetch-code-built-to-steal-swarm-wallet-keys/ (gunzipped, HTML to text); stored sha256 re-computed on the decompressed files and matched the manifest for all six. suspicious_patterns is null for all six; a separate regex pass over the extracted text found no instruction-like text addressed to an AI reader (the only hit, in source-5, is the unrelated related-post title 'Zero Trust for AI Agents'; no instruction followed). Allowlist: thehackernews.com, socket.dev, github.com and pluto.security are all present in config/source_allowlist.txt (pluto.security was added earlier with a justification comment); no addition needed. SafeDep is not cited (its findings reach the article via The Hacker News). SOURCE 0 (The Hacker News, source-0, sha256 9d24ab3a0f42b8f502f389b64eebff8d41fee9f87658800c534cecbc0d7a903e, 200): byline Swati Khandelwal, Nov 09, 2026; lead 'Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools ... bee-js 13.3.0 and Swarm Desktop 0.56.2'; 'built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password'; Swarm Desktop 0.56.2 'at about 00:36 UTC today'; updater offer within about 10 minutes per Socket; bee-js latest 'about 75 minutes, from 00:09 to 01:25 UTC'; 'Both releases came from bee-worker, the account Ethersphere uses to automate its releases. Neither change was signed nor submitted as a pull request'; workflow 'needed no approval and published the package to npm in 73 seconds, according to Socket'; provenance sentence quoted verbatim; signing jobs now wait for DevOps approval; loader and SafeDep details (api.frameworkmetrics[.]xyz, config.yaml, data-dir/keys/swarm.key, plain-text password, xDAI/xBZZ/chequebook/stake, evjawbreaker, ScreenConnect/ConnectWise); 29 minutes gap; swarm-cli/bee-dashboard ranges; '10 times' and 65 downloads; 'None of the reports gave a count of infected machines'; 'No theft of funds had been reported at the time of writing'; Pluto link and 'Socket says the same group is behind' all confirmed. SOURCE 1 (Socket, source-1, sha256 acc464a40b2c18f844b50939450c1f1d582258d7a41535f7645a8bdb6168a6d3, snapshot status 200 and full 21-minute article): the writer saw a 403, so the route was checked: (a) the stored snapshot is the complete article (Socket Research Team, Nov 9, 2026); (b) a live curl with a Chrome User-Agent returned 403 'Just a moment...' (Cloudflare bot check, 5,647 bytes, sha256 4b57b11c08ef88bcad8b096c2ffce6ed5f97c80cb377a22f750d03078e7aaf79), so bot-block risk is real; (c) an Archive.org capture web.archive.org/web/20261109185619/https://socket.dev/blog/bee-js-compromise (200, 644,378 bytes, sha256 62f97bc55d8392f5a7f58d75099391517643776e561d8e2800bc5100938dd4ca) contains the same text; every timestamp the article uses (23:30:47, 00:06:01, 00:09:50, 01:24:58, 01:25:27, 09:04, 09:14, 73 seconds, 65 by 08:27, 'on the order of ten fetches', three loader runs, package-manager defaults) was found in both. Socket lead: 'a threat actor used the project's own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub'; 'Socket's analysis indicates two GitHub accounts were compromised: nugaon, a maintainer ... and bee-worker'; 'the origin of both compromises ... remains unexplained'; 'Whether the served code read the runner's environment or requested an OIDC token cannot be determined from public data'; the 29-minute contract-write gap; 'npm 11 and earlier, Yarn Classic, and Yarn Berry before 4.14.0 run dependency postinstall scripts by default. npm 12, pnpm 10 and later, Yarn Berry 4.14.0 and later, Bun and Deno skip ...'. SOURCE 2 (GHSA-hh7j-5m3j-23pf, source-2, sha256 ebdf9b840e9847aa71694a54a8b0f51b8d48f2fbb0f8774a277ad5559bd95224, plus GitHub API /advisories/GHSA-hh7j-5m3j-23pf): 'Malware in @ethersphere/bee-js', npm, affected '= 13.3.0', patched versions None, published Nov 9, 2026 (API published_at 2026-11-09T01:25:27Z, matching Socket), CWE-506, cve_id null, cvss null/0.0 (the API record carries a 'critical' severity label that the web page does not display; the article asserts neither CVE nor CVSS nor severity, which is correct); the quoted sentence 'Any computer that has this package installed or running should be considered fully compromised.' is verbatim. SOURCE 3 (PR #582, source-3, sha256 590badefedcd9259f8b960b87236e8aba27376bfe0f559dc0fab1ab0b054d047, plus GitHub API): created 2026-11-09T12:22:28Z, merged 12:30:18Z; PR body 'v0.56.2 was built and published by an attacker using stolen CI credentials (stolen secrets, unreviewed tag-only commit 2de7270). It has been withdrawn.' and 'same code as 0.56.1 ... Because 0.56.3 > 0.56.2, the auto-updater will move any installs of the malicious build to it. No code changes.' The article's quoted words 'was published by an attacker using stolen CI credentials and has been withdrawn' are verbatim from the PR's commit message (shown on the PR page and returned by the API), not from the PR description, which words it differently. SOURCE 4 (release v0.56.3, source-4, sha256 25cce6545ca7366d627f523a7efcda4eeaa14baa723cf2b9a9875b88c5d2a12a, plus API): published_at 2026-11-09T12:52:07Z, notes 'replace compromised 0.56.2 release' (twice), release author bee-worker; release v0.56.2 and its tag now return 404 (consistent with Socket's tag deletion). SOURCE 5 (Pluto, source-5, sha256 668938161df26548e148962778abcf266771aa7dd148c2cdbb1189de0d15a60a, Oct 01, 2026): 'We assess with high confidence that this is the same actor behind the earlier SleepyDuck and ScreenConnect campaigns' (about EtherDuck, September 2026); Pluto predates and does not mention bee-js or Swarm Desktop, and the article does not claim it does: the link to this incident is correctly given as The Hacker News's and Socket's. Registry check (not cited, for verification only): registry.npmjs.org time['13.3.0'] = 2026-11-09T00:09:50.630Z, matching Socket exactly; dist-tags.latest is now 13.2.0. Independent-source recount: independent news outlets = 1 (The Hacker News, whose account derives from Socket and SafeDep); security-vendor research blogs = 2 (Socket, whose analysis underlies THN, and Pluto, which covers only the earlier campaign), not independent news; first-party = 3 (GitHub advisory, the project's PR, the project's release page). The article's own statements ('the only news outlet among the cited sources'; 'no second news outlet') are accurate and scoped. Anthropic disclosure: not required - neither Anthropic nor Claude is the subject or named in the headline, summary, lead or body (Socket's page navigation lists Anthropic as a customer story and a Cursor co-author trailer appears in Socket only; neither is in the article). Analysis requirements: not applicable (News).

Rule 12 / title test: the title states a MECHANISM as fact. Sources: The Hacker News (own voice, lead): 'Attackers used the Ethersphere project's own release automation to publish malicious versions'; Socket (own voice, lead): 'a threat actor used the project's own GitHub automation to publish' and, in its analysis, 'the legitimate workflow, running legitimate workflow code from the tag, published the threat actor's commit' (73 seconds, no approval; publish environment has no required reviewers); maintainers (commit/PR): 'published by an attacker using stolen CI credentials'. Established by Socket's log and workflow analysis (public job log, attestation verified offline, GitHub push-actor records) and relayed by THN, with the maintainers confirming stolen CI credentials. No source hedges it ('appear to have' is absent); the only uncertainty the sources state is HOW the credentials were stolen, and the article reports that under What We Don't Know. For Swarm Desktop the 'release automation' is the manually dispatched pre-release.yml build (Socket) that THN also describes. The title is therefore not stronger than the sources and no hedge is needed; the summary additionally attributes to THN. Claim-by-claim: summary and lead (published Nov 9, 2026; npm and GitHub; both run a loader; 0.56.3 replaces 0.56.2) confirmed. Times verified against raw sources: 23:30:47 (Socket, 29 min before commit at 23:59:54 client-set time), 00:06:01 / 00:09:50 (Socket; npm registry), ~00:36 (THN; Socket's assets uploaded 00:41-00:44, updater offers 00:43:17 / 00:44:49), 01:24:58 / 01:25:27 (Socket; GHSA API), 09:04 / 09:14 (Socket), 12:52 (release API). Chronological order is correct; no cause is implied by juxtaposition (the contract-write gap is stated by both sources). Quantifier and absence scan run on the submission: 'both releases' (loader, key theft) holds for each (Socket: both paths post config.yaml and swarm.key); 'neither malicious change was signed or submitted as a pull request' is THN's and matches Socket for the two commits it describes; 'the only news outlet among the cited sources' and 'no second news outlet' checked against all six sources: true; 'no theft of funds had been reported' is scoped to THN at time of writing. 'Intel Macs were never offered it' and 'Linux does not update automatically' match Socket. No CVE/CVSS asserted. Three subordinate points need a clarification (see concerns): (1) 'both releases carry the same few-line loader' is SafeDep via THN; Socket states the two loaders are 'not identical code' (different path /v1/analytics vs /v1/electron, https.get vs https.request, 3 s timeout and error swallowing vs none) though the same new Function sink and headers; (2) 'both came from bee-worker' is THN's; Socket reports that the commit repairing the build workflow for the 0.56.2 build was pushed through the maintainer's account, and the article's own What We Don't Know already lists both accounts; (3) 'The Swarm Desktop maintainers wrote' is plural while the quoted commit message is from the single-author PR #582 (THN: 'one of them wrote').

Accurate, well-sourced and neutral coverage of a supply-chain compromise; the headline mechanism is stated by two sources in their own voice and corroborated by the maintainers, every timestamp matches raw data, and the quoted passages are verbatim. Three subordinate clarifications are filed as a corrections record; the signed article is not edited. Featured candidacy: 2 - notable supply-chain incident whose mechanism (valid npm provenance and Apple notarization on malicious builds, release-event publishing without approval) applies to any npm or Electron maintainer, though actual exposure was small (about ten bee-js fetches, 65 desktop downloads).