Attackers hijacked the Ethersphere project's own release system to push out malicious versions of two of its tools for the Swarm decentralised storage network, turning trusted downloads into wallet-stealing malware.

The compromised releases were bee-js version 13.3.0, published to the npm package registry, and Swarm Desktop version 0.56.2, published on GitHub. Both appeared on Monday 9 November 2026 and were withdrawn the same day, but anyone who installed or ran them must treat the machine as compromised.

What the malicious releases did

Both releases carried a small loader that downloaded further code and ran it with the user's full permissions. That code looked for two files in the Swarm Desktop data folder: config.yaml and the node's wallet key file, data-dir/keys/swarm.key. It sent both to the attackers' server.

The key file is an encrypted Ethereum keystore, but Swarm Desktop keeps the password that unlocks it in plain text in config.yaml. With both files, the attackers can take control of the node's wallet, including its xDAI and xBZZ tokens, its chequebook funds and its stake.

The downloaded code also installed a backdoor designed to survive a reboot. On Linux and macOS it is a Go remote shell known as evjawbreaker, hidden in a .solidity folder and started automatically. On Windows it installed a genuine ScreenConnect remote-access client, signed by its maker ConnectWise, running as a system service.

How long the bad versions were live

The bee-js release was the latest version on npm for about 75 minutes, from 00:09 to 01:25 UTC on 9 November, before npm removed it. Researchers recorded about ten downloads in that window, including scanners and mirrors, so the download count is not a victim count.

Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC and was withdrawn about eight and a half hours later. Its download count reached 65 by 08:27 UTC, again including researchers. No theft of funds had been reported at the time of writing.

Ethersphere has since restored bee-js 13.2.0 as the latest clean version and released a clean Swarm Desktop 0.56.3, which the maintainer said contains the same code as 0.56.1 under a new certificate.

How the attackers got in

Both releases came from bee-worker, the account Ethersphere uses to automate its releases. The maintainer said version 0.56.2 was published by an attacker using stolen CI credentials. Analysis by security firm Socket found that two GitHub accounts were compromised: the bee-worker automation identity and a long-time maintainer's account. The malicious commits were unsigned and made with no pull request.

Socket also linked the attack to an earlier campaign. The payloads read their command-and-control address from an Ethereum smart contract previously used by malicious Solidity extensions on the Open VSX marketplace, in a campaign documented as SleepyDuck or EtherDuck.

What to do if you installed them

Updating alone does not fix this. Neither installing the clean releases nor removing the bad ones takes away a backdoor that is already installed, and it does not protect a key that has already been sent out.

Anyone who installed bee-js 13.3.0 or ran Swarm Desktop 0.56.2 should treat the machine as fully compromised. From a clean computer, move the node's funds, chequebook and stake to a new key, and rebuild or reinstall the affected machine. The GitHub advisory for bee-js states plainly that any computer with the package installed or running should be considered fully compromised.

Swarm Desktop runs a Bee node on a user's own computer, and bee-js is the JavaScript client library behind it and the swarm-cli command-line tool. That is what made the hijack so effective: the malware arrived through the project's own trusted release channel, with valid provenance on npm and a signed, Apple-notarised installer on macOS.