Threat watch / Attack
Ethersphere: poisoned bee-js and Swarm Desktop releases steal Swarm wallet keys
On November 9, 2026, an attacker published a malicious @ethersphere/bee-js 13.3.0 on npm and a malicious Swarm Desktop 0.56.2 through the project's own release pipeline, using compromised GitHub accounts. The code sent Swarm node wallet keys and their password to the attacker and installed a remote backdoor. Both releases were withdrawn within hours; downloads stayed low, and no theft of funds had been reported.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- @ethersphere/bee-js, Swarm Desktop, npm
- downloads of the malicious Swarm Desktop 0.56.2, researchers included (upper bound, according to Socket)[3]
- 65
- How it happened
- Users were hit through the update channel: the malicious bee-js runs its loader on install, and Swarm Desktop on each launch, with the auto-updater offering 0.56.2 to Windows x64 and Apple Silicon Macs. The project says 0.56.2 "was built and published by an attacker using stolen CI credentials". Socket says two GitHub accounts were compromised, a maintainer's and the bee-worker release bot; how they were first compromised is not explained.[2][3][5] Checked 10 Nov 2026
- What was stolen
- The second stage reads Swarm Desktop's config.yaml and the swarm.key file and sends them to the attacker; the config holds the keystore password in plain text, which hands over the node wallet (xDAI, xBZZ, chequebook funds and stake). A third stage installs a remote shell on macOS and Linux and a ScreenConnect client as a system service on Windows. No theft of funds had been reported.[3][4][5] Checked 10 Nov 2026
- Who was impacted
- People and build systems that installed bee-js 13.3.0 (about 10 downloads, including scanners and mirrors, according to Socket) or ran Swarm Desktop 0.56.2 (65 downloads by 08:27 UTC, including researchers, which Socket calls upper bounds). GitHub's advisory says any computer with the package installed or running "should be considered fully compromised".[1][3] Checked 10 Nov 2026
- Threat actor
- Not attributed. Socket links the operator to the earlier SleepyDuck and EtherDuck campaigns, citing a reused Ethereum contract, wallet, backdoor builds and ScreenConnect relay.
Timeline
- A first attempt to harvest secrets through the swarm-desktop and swarm-cli workflows fails; Socket assesses with moderate confidence that nothing was taken. [3]
- Shortly after midnight UTC, an unsigned commit by the bee-worker account and a GitHub release publish bee-js 13.3.0 to npm, with a genuine provenance attestation; it is removed about 75 minutes later and GitHub issues advisory GHSA-hh7j-5m3j-23pf. Swarm Desktop 0.56.2 appears at about 00:36 UTC and is withdrawn hours later. [1][3][5]
- The project releases Swarm Desktop 0.56.3, the same code as 0.56.1 signed with a newly issued Developer ID certificate, so the auto-updater moves installs off the malicious build. bee-js 13.2.0 is again the latest version. [2][4][5]