Hackers hijack Ethersphere’s bee-js and Swarm Desktop to steal wallet keys

On November 9, the software release system of Ethersphere was taken over by hackers who used it to send out malware using bee-js 13.3.0 and Swarm Desktop 0.56.2.

This malware was programmed to look for Bee node wallet private keys, thereby giving the hackers access to the affected devices. While the bee-js package stayed on npm for about 75 minutes, the Swarm Desktop release remained online for almost eight and a half hours.

Signed, provenanced, and still malicious

The worrying part of this breach is that the software appeared legitimate. Cybersecurity firm Socket confirmed that bee-js had valid SLSA provenance. Swarm Desktop’s macOS installer had been signed and Apple-notarized. It could be auto-updated for users of Apple Silicon and Windows.

Checks showed the origin of the software but not its safety. The hackers inserted malicious code into trusted workflows. Socket linked the hack to compromised GitHub accounts, including release bot bee-worker. However, how the access was obtained is still not known.

What the loader steals

StepSecurity discovered that attackers had modified scripts/generate-version.cjs to download malicious code from api.frameworkmetrics[.]xyz. The script ran automatically when developers installed bee-js 13.3.0, even if they never used the library.

The malware then searched for two files: config.yaml and data-dir/keys/swarm.key. The first contained the password needed to unlock the encrypted wallet key stored in the second. With both files, attackers could gain control of a Bee node wallet.

The malware also installed backdoors to maintain remote access. On Windows, it used ScreenConnect. On Linux and macOS, the backdoors masqueraded as legitimate Solidity development tools.

The same wallet behind SleepyDuck

Socket has found that the malware made use of Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 in order to find its command-and-control servers. Pluto Security had connected the same contract to the SleepyDuck and EtherDuck campaigns, which distributed malware using fake Solidity extensions.

However, in the present breach, the hackers have taken a different approach. They have attacked Ethersphere’s authentic software releases instead of convincing the developers to download fake software. The method resembles the previous npm supply-chain attack reported by Cryptopolitan, where hackers distributed malware through Arweave’s WeaveDB project packages.

What operators need to do now

In two official notices, Ethersphere identified both releases as malicious. Maintainer darkobas2 said in a recovery pull request that 0.56.2 “was built and published by an attacker using stolen CI credentials.” The clean replacement, 0.56.3, was “same code as 0.56.1,” signed with a new certificate.

Users should check their Desktop version and install 0.56.3; Linux users must update manually. Anyone who ran the malware should isolate and rebuild the computer, move funds and stake from a clean device, and rotate credentials. bee-js users should pin 13.2.0. An update alone won’t remove a backdoor.

Socket recorded 65 downloads of the tainted Desktop release by 08:27 UTC on November 9, including researchers, and estimated about ten bee-js 13.3.0 fetches. Neither is a victim count. No confirmed tally of infected machines or stolen funds exists.

Reading the market, not inventing it

On CertiK’s dashboard, wallet compromise ranks second by 2026 losses ($769.1 million) and third by incidents (75). Private-key compromise is fifth by losses ($158 million) and fourth by incidents (47). Those are industry-wide figures, not Ethersphere losses.

CoinGecko priced BZZ near $0.0654 on November 10, but no breach-driven selloff has been established. The bigger warning is about software trust: authentic updates can still steal keys.