[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnYkJjpvGbvKyoxWOwhxQgmUq1hxy8ZaNv6Cl4t9cyjM":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"461e77a4-1d01-4a14-bcf3-23c884ac0948","Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware","hackers-compromise-ethersphere-s-bee-js-and-swarm-desktop-to-deliver-wallet-stea-2ba6cb","Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the wallet key that Swarm Desktop keeps for its node, along with the stored password that unlocks it. The code is also built to install a backdoor","Attackers used stolen CI credentials to publish malicious versions of Ethersphere's bee-js JavaScript library (v13.3.0) and Swarm Desktop (v0.56.2), both designed to steal private wallet keys and passwords while installing backdoors. The bee-js package was available on npm for 75 minutes and executed malicious code via postinstall scripts; Swarm Desktop reached approximately 65 downloads before removal. Ethersphere released a clean Swarm Desktop 0.56.3 and advised treating any affected machines as fully compromised.","Attackers compromised Ethersphere's CI\u002FCD to publish malicious bee-js and Swarm Desktop releases stealing wallet keys.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-compromise-etherspheres-bee-js.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg4ZFiesBwDTk8fRRfKfNIw0lLkhqF6ZAExRxuuRtfRCWrxs6Rg7M5UdSIcJqH2zstViFreL30JMmdebYTlMOKvg4D6GvaS70XPdembzyIZoX2KBj_S3kxKWmBjJll4exWUYXrap9IDW_ugXHOux5jZXk44_v5xac1mxFouywezDcsGeMdLrGd1sJStMoo\u002Fs1600\u002Fbees.jpg","2026-11-09T17:36:28+00:00","2026-11-09T19:00:27.597496+00:00",9,[17,20,22,24,27],{"name":18,"type":19},"bee-js","product",{"name":21,"type":19},"Swarm Desktop",{"name":23,"type":19},"swarm-cli",{"name":25,"type":26},"Ethersphere","vendor",{"name":28,"type":29},"npm","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,55],{"type":45,"value":53,"context":54},"bee-js 13.3.0","Malicious npm package version with postinstall script stealing wallet keys and installing backdoor",{"type":45,"value":56,"context":57},"Swarm Desktop 0.56.2","Compromised desktop application release designed to steal private keys and passwords",[25,18,21],{"controls":60,"vendors":141},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"stolen-ci-credentials-enable-malicious-npm-package-publishing-in-ethersphere-attack","Stolen CI Credentials Enable Malicious npm Package Publishing in Ethersphere Attack","Attackers compromised CI\u002FCD credentials to publish trojanized versions of bee-js and Swarm Desktop, injecting wallet-stealing malware via npm postinstall scripts — a classic software supply chain attack. The incident highlights how a single set of stolen pipeline credentials can weaponize trusted packages delivered to hundreds or thousands of developers and end-users within minutes. The 75-minute window the malicious bee-js package remained on npm before removal demonstrates how quickly supply chain attacks can achieve wide impact before detection. Organizations relying on third-party open-source packages must treat their dependency pipelines as a critical attack surface requiring the same rigor as internal infrastructure.",[147,148,149,150,151,152,153],"CIS Control 2: Inventory and Control of Software Assets","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"MITRE ATT&CK T1566: Phishing":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"CIS Control 17: Incident Response Management":157,"OWASP A06:2021 Vulnerable and Outdated Components":158,"CIS Control 2: Inventory and Control of Software Assets":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"While direct phishing is not confirmed, credential theft used to compromise CI accounts often originates from phishing or credential stuffing — highlighting that protecting pipeline secrets requires the same user-focused defenses as endpoint credential protection.","SI-2 covers integrity verification of software and components; applying it to third-party supply chain artifacts — including verifying package provenance before installation — would have provided a control against the malicious publish.","Ethersphere's rapid detection and release of a clean 0.56.3 version shows incident response capability, but a formal IR plan including pre-defined playbooks for supply chain compromise would reduce response time and downstream user impact.","This risk category directly covers the danger of consuming unverified or compromised third-party components; rigorous vetting of package updates — including postinstall script review — is the prescribed countermeasure.","Maintaining an authoritative inventory of approved third-party packages and their pinned versions would have flagged the unauthorized v13.3.0 release before it was consumed by downstream users.","This control requires organizations to monitor for vulnerabilities in software components in use, which extends to tracking integrity and authenticity of third-party packages in the dependency chain.","The root enabler was stolen CI credentials; enforcing MFA and least-privilege access on pipeline service accounts directly addresses the initial access vector used in this attack."]