Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

Threat actors compromised Ethersphere's GitHub automation pipeline to publish malicious versions of a trusted npm package and desktop application, embedding a loader that fetched and executed arbitrary JavaScript with full Node.js privileges. This is a classic software supply chain attack: by hijacking the build and release infrastructure rather than the source code directly, the attacker bypassed typical code review processes and inherited the trust users placed in the legitimate publisher. The reuse of infrastructure from a prior campaign (SleepyDuck/EtherDuck) suggests a persistent, targeted threat actor operating against the Ethereum ecosystem. This matters because downstream developers and end users who automatically consume package updates are silently compromised with no visible warning. Trust in open-source ecosystems depends on the integrity of CI/CD pipelines and package signing, both of which failed here.