Hackers hijack Ethersphere’s bee-js package and Swarm Desktop app to push wallet-stealing malware

Attackers turned Ethersphere’s own release pipeline against its users. Malicious builds of the @ethersphere/bee-js npm package and the Swarm Desktop app shipped through official channels, carrying malware designed to steal wallet keys.

What happened

On November 9, 2026, Ethersphere’s automated release process was compromised. The result was two poisoned releases: bee-js version 13.3.0 and Swarm Desktop version 0.56.2.

The malicious npm package went out around 00:09 UTC. The desktop app followed at roughly 00:36 UTC, about 27 minutes later.

The attackers did not need to sneak in through a side door. The breach ran through the legitimate release workflow, using either the bee-worker bot or stolen Continuous Integration (CI) credentials.

The tampered packages included postinstall hooks. These are scripts that run automatically the moment a package is installed, with no extra click required from the user.

Those scripts reached out to a server controlled by the attackers and downloaded additional payloads. Installing the package was effectively the same as running the attacker’s code.

What the malware went after

The payloads hunted for sensitive Swarm node wallet files. Targets included config.yaml and data-dir/keys/swarm.key.

The second file contains an encrypted Ethereum keystore, but the password needed to unlock it sat in plaintext nearby. The stolen files were exfiltrated to the attackers.

The goal, per the research findings, was to drain xDAI and xBZZ tokens, along with chequebook funds and stake tied to Swarm nodes. That covers both the liquid balances and the money node operators had committed to running their infrastructure.

The malware also installed persistent backdoors, giving the attackers continued access to compromised systems across multiple platforms.

The official response

GitHub advisory GHSA-hh7j-5m3j-23pf was blunt in its assessment. Any machine that installed the compromised package should be treated as “fully compromised.”

Ethereum Swarm moved to its Discord to urge users to secure their systems and replace the affected desktop release. Affected users have been told to remove the backdoors and replace their wallet keys.

Replacing keys is the critical step. If the attacker already holds a copy of your keystore and its password, patching the software does nothing to protect funds still sitting behind those keys.

A familiar fingerprint

The attack used infrastructure linked to a previous malware operation known as the SleepyDuck campaign.

Why supply-chain attacks hit differently

In a supply-chain attack, the target is not one wallet or one protocol. It is the distribution channel that everyone trusts by default.

Developers pulling bee-js from npm and users updating Swarm Desktop were doing exactly what good security hygiene recommends. They installed official releases from the official source.

The postinstall hook mechanism adds another layer of risk. Package managers like npm allow these scripts for legitimate reasons, such as compiling native code, but the same convenience lets malicious code execute before anyone has a chance to inspect it.

What this means

For Swarm node operators, the priority list is short and urgent. Anyone who installed bee-js 13.3.0 or Swarm Desktop 0.56.2 needs to treat their machine as compromised, remove persistence mechanisms, and move to new wallet keys.

Simply upgrading to a clean version is not enough on its own. The keys that were exposed stay exposed, and the backdoors stay in place until someone removes them.

For developers who depend on bee-js inside their own projects, the exposure could extend further. A compromised dependency can turn a build server or a teammate’s laptop into an entry point, so dependency audits and lockfile reviews are worth doing now rather than later.

The research findings flag broader concerns about the integrity of development tools and package management systems. Compromises of legitimate software could shake user confidence in the security of decentralized applications more generally.

For Ethersphere, the harder work starts after the cleanup. Restoring trust will likely depend on how quickly it explains the root cause, whether the bee-worker bot or stolen CI credentials, and what changes it makes so that a single compromised pipeline cannot ship malware again.