Hackers Compromise Ethersphere Tools to Deliver Wallet-Stealing Malware
Attackers injected wallet-stealing malware into Ethersphere's bee-js and Swarm Desktop software by compromising the project's release automation, potentially exposing user node wallet keys and passwords.
Attackers have successfully compromised the release automation process for Ethersphere's bee-js and Swarm Desktop tools, injecting malicious code into versions 13.3.0 of bee-js and 0.56.2 of Swarm Desktop. These compromised versions were designed to steal the private keys for users' Swarm nodes and any associated stored passwords, while also installing a backdoor on affected Windows, macOS, and Linux systems.
The bee-js package serves as the JavaScript library underpinning Swarm Desktop and the swarm-cli command-line tool. Swarm Desktop itself runs a Swarm node locally on a user's computer, storing the node's private keys directly on the machine. The malicious code embedded within these releases targeted this sensitive information.
Both malicious releases have since been removed from distribution. Ethersphere's maintainers have issued a clean update for Swarm Desktop, version 0.56.3. However, these actions do not remove any backdoors that may have already been installed on compromised systems, nor do they recover any keys that may have already been exfiltrated.
Swarm Desktop version 0.56.2 was available on GitHub for approximately 8.5 hours before being withdrawn. According to analysis by supply chain security firm Socket, the application's automatic updater could have delivered the malicious version to Windows x64 computers and Apple Silicon Macs within about 10 minutes. Intel Macs were not affected, and Linux installations do not feature automatic updates.
The compromised bee-js version 13.3.0 was available on the npm registry for about 75 minutes. Its malicious payload was executed as a postinstall script, which npm runs automatically upon installation unless explicitly disabled. This meant that users could be infected simply by installing the package, without needing to actively import the library into their projects.
While the exact number of infected machines remains unknown, security firms estimate that bee-js 13.3.0 was downloaded around 10 times, including by security scanners and mirrors. Swarm Desktop 0.56.2 saw approximately 65 downloads by the time it was identified.
Ethersphere's maintainers confirmed that the attacker gained access using stolen CI credentials. The clean release, version 0.56.3, reportedly contains the same code as version 0.56.1, but is signed with a new developer certificate. While the auto-updater is expected to push this fix to affected Swarm Desktop users, Linux users will need to manually replace the package. The compromised bee-js package has been removed from npm, with version 13.2.0 now being the latest available.
Security advisories from SafeDep and GitHub strongly recommend that any system that had bee-js 13.3.0 installed or running should be considered fully compromised. Users are advised to search for and remove the malicious package, pin to a known good version, and rotate any credentials, tokens, or keys that may have been accessible. For Swarm Desktop users, checking log files for version 0.56.2 and installing 0.56.3 is crucial. If the compromised version was run, the node's key and password should be treated as stolen, and funds should be moved to a new key from a clean system. Furthermore, specific malware components like the evjawbreaker backdoor need to be manually removed, and rebuilding affected machines from a trusted image is the most secure remediation.