Ethersphere bee-js Supply-Chain Breach: Hackers Ship a Wallet Stealer
Ethersphere bee-js Supply-Chain Breach: Hackers Ship a Wallet Stealer
Attackers used the Ethersphere project's own release automation to publish malicious versions of two Swarm storage tools: bee-js 13.3.0 and Swarm Desktop 0.56.2.
Both releases download and run code built to steal the wallet key Swarm Desktop keeps for its node, along with the stored password that unlocks it — plus a backdoor on Windows, macOS, and Linux. The releases have been withdrawn; the backdoors are not.
What Shipped
Swarm Desktop 0.56.2 appeared on GitHub at 00:36 UTC and was withdrawn about 8.5 hours later. Its built-in updater could offer it to Windows x64 and Apple Silicon Macs within about 10 minutes, according to Socket's incident analysis. Linux installs never auto-updated.
The bee-js release, version 13.3.0, was the latest on npm for about 75 minutes (00:09–01:25 UTC). Its code runs as a postinstall script — npm executes install scripts automatically, so a project never had to import the library.
The project's own swarm-cli and bee-dashboard, and the Swarm Desktop source, accepted version ranges including 13.3.0. A fresh install inside that window could have pulled the malicious version.
How Much Spread
Rough estimates: bee-js 13.3.0 was downloaded about 10 times (including scanners and mirrors). Swarm Desktop 0.56.2 reached 65 downloads by 08:27 UTC, including researchers. No theft of funds had been reported at the time of writing.
The maintainers withdrew 0.56.2 and shipped clean 0.56.3, re-signed with a newly issued Developer ID certificate. The incident note says 0.56.2 "was published by an attacker using stolen CI credentials."
How the Malware Works
Both releases carry the same loader (analyzed by SafeDep). A few lines of code download more code from api.frameworkmetrics[.]xyz and run it with user permissions — as bee-js's postinstall script, or at every Swarm Desktop start.
The payload hunts for config.yaml and data-dir/keys/swarm.key in Swarm Desktop's data folder. The key file is an encrypted Ethereum keystore, but Swarm Desktop keeps its password in plain text in config.yaml. With both files, attackers can drain the node's xDAI/xBZZ tokens, chequebook funds, and stake.
The backdoors: on Linux/macOS, a Go remote shell named evjawbreaker in a hidden ~/.solidity/ folder, running as a systemd user service or macOS LaunchAgent, reading its control-server address from an Ethereum smart contract. On Windows, a genuine signed ScreenConnect client installed as a system service, gaining admin rights via a UAC bypass and adding a Defender exclusion.
How the Releases Got Out
Both releases came from bee-worker, the project's release-automation account. Neither change was signed nor sent as a pull request. For bee-js, publishing a GitHub release started the npm workflow, which needed no approval and published in 73 seconds. For Swarm Desktop, attackers manually started a signing workflow holding the project's Apple and Windows certificates — no approval required. The macOS app was properly Developer-ID-signed and notarized, so macOS showed only its normal first-launch prompt.
The maintainers have since added approval gates: signing jobs now wait for DevOps approval and run only from main.
What to Do
- If you use bee-js: Search lockfiles, caches, internal registries, and CI logs for
@ethersphere/bee-js@13.3.0. Pin 13.2.0 and clear cached copies. If install scripts were on, treat the machine as compromised — the code hides its own network errors. - If you run Swarm Desktop: Look for
Bee Desktop version: 0.56.2inbee-desktop.log(~/Library/Logs/Swarm Desktop/,%LOCALAPPDATA%\Swarm Desktop\Log\,~/.local/state/Swarm Desktop/). Install 0.56.3; on Linux replace by hand. If 0.56.2 ever ran, treat the node's key and password as stolen. - On any affected machine: Remove
~/.solidity/, thesolidity-langsupport-runner.service, thecom.solidity.langsupport.runnerLaunchAgent, and the ScreenConnect client. Updating the app does not remove them — where possible, rebuild from a trusted image.
Sources
AI Security Starter Training
Request a practical checklist for prompt injection, RAG data leakage, MCP risks, and model-file security before launch.
Related Services
Scope Estimator
Get a rough engagement size before the scoping call.
- What this depth covers
- Full coverage of the OWASP-family test plan for the in-scope targets: broken access control, injection, authn and authz flaws, business-logic abuse, findings with reproduction steps.
- What it does not cover
- Multi-week adversary emulation, physical and phishing vectors, custom exploit development, source-code review.
Indicative effort
~5 tester-days
Estimate only, not a quote. It scales with the three factors above and assumes the targets are reachable and test accounts are provided in the test window.