Stolen CI access published a malicious bee-js release and a trojanized Swarm Desktop build

On November 9, 2026, attackers used compromised access to Ethersphere’s GitHub release automation to publish a malicious npm package and a trojanized desktop app for the Swarm decentralized storage network. Socket, SafeDep and The Hacker News all published the same day.

What shipped

• @ethersphere/bee-js 13.3.0 sat as the latest npm version for about 75 minutes (roughly 00:09 to 01:25 UTC). A postinstall script downloaded and ran remote JavaScript. npm removed it afterward; 13.2.0 is again the latest.
• Swarm Desktop 0.56.2 appeared as a GitHub release around 00:36 UTC and stayed up for about 8.5 hours. The macOS build was signed with the project’s Developer ID and notarized by Apple. The app’s auto-updater could offer it to Windows x64 and Apple Silicon Macs within about ten minutes. Intel Macs were never offered it; Linux does not auto-update.

Both carry a small loader that fetches more code from api.frameworkmetrics.xyz and runs it with the user’s privileges. Researchers link the later stages to the SleepyDuck / EtherDuck campaign that abused fake Solidity extensions on Open VSX earlier this year: the same Ethereum configuration contract, the same ScreenConnect relay on Windows, and the same “Solidity language support” persistence names on macOS and Linux.

What the malware does

If Swarm Desktop’s data folder is present, the downloaded code steals config.yaml (which holds the node password in plain text) and the encrypted swarm.key wallet file, then sends them to the attackers. With both files, researchers say, the node’s xDAI and xBZZ balances, chequebook funds and stake can be taken.

It also installs remote access: a Go backdoor called evjawbreaker under ~/.solidity/ on Linux and macOS, and a genuine ConnectWise ScreenConnect client as a hidden system service on Windows. Updating or removing the package or app does not remove those implants.

Socket estimates on the order of about ten fetches of bee-js 13.3.0, including scanners. Swarm Desktop 0.56.2’s download counters reached 65 by 08:27 UTC, including researchers. No theft of funds had been reported when The Hacker News published. Maintainers withdrew 0.56.2 and published a clean 0.56.3 built from the prior good code and a new signing certificate.

What you can do

1. Search lockfiles and caches for @ethersphere/bee-js@13.3.0 and pin 13.2.0. Clear mirrors and caches that still hold 13.3.0.
2. If 13.3.0 installed with scripts enabled, treat that machine or CI runner as compromised. Rotate every password, token and key that environment could read, from a clean computer.
3. For Swarm Desktop, check bee-desktop.log for “Bee Desktop version: 0.56.2”. Install 0.56.3 (replace Linux packages by hand). If 0.56.2 ran, move the node’s funds and stake to a new key from a clean machine.
4. Remove persistence: ~/.solidity/, solidity-langsupport-runner.service (Linux), com.solidity.langsupport.runner (macOS), and ScreenConnect Client (5cbe79c9c25524df) (Windows). Rebuild from a trusted image when you can.
5. See our earlier GhostAction live story for a related pattern of stolen developer credentials feeding supply-chain releases.

How Frame helps

Frame watches for new breach disclosures against your verified emails and gives you a short checklist when something hits. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame does not scan developer machines for this malware; the steps above are the ones researchers recommend.

Related coverage

• Hijacked developer accounts are planting credential stealers on GitHub and npm: the GhostAction campaign, which researchers separately tied to overlapping PolinRider infrastructure.
• PolinRider hid loaders in 10 npm packages and used Ethereum to find its servers: another npm loader that resolves its next stage through Ethereum.

Sources

• Socket, Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor, November 9, 2026
• SafeDep, Compromised bee-js and Swarm Desktop Steal Swarm Wallet Keys, November 9, 2026
• The Hacker News, Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware, November 9, 2026