Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Attackers compromised Ethersphere's CI/CD to publish malicious bee-js and Swarm Desktop releases stealing wallet keys.
Attackers used stolen CI credentials to publish malicious versions of Ethersphere's bee-js JavaScript library (v13.3.0) and Swarm Desktop (v0.56.2), both designed to steal private wallet keys and passwords while installing backdoors. The bee-js package was available on npm for 75 minutes and executed malicious code via postinstall scripts; Swarm Desktop reached approximately 65 downloads before removal. Ethersphere released a clean Swarm Desktop 0.56.3 and advised treating any affected machines as fully compromised.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ethersphere?
Get an email when a new story names Ethersphere, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised CI/CD credentials to publish trojanized versions of bee-js and Swarm Desktop, injecting wallet-stealing malware via npm postinstall scripts — a classic software supply chain attack. The incident highlights how a single set of stolen pipeline credentials can weaponize trusted packages delivered to hundreds or thousands of developers and end-users within minutes. The 75-minute window the malicious bee-js package remained on npm before removal demonstrates how quickly supply chain attacks can achieve wide impact before detection. Organizations relying on third-party open-source packages must treat their dependency pipelines as a critical attack surface requiring the same rigor as internal infrastructure.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — bee-js 13.3.0
- malware — Swarm Desktop 0.56.2