Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
Summary: Attackers used Ethersphere's own release automation to publish malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2, which download code that steals the Swarm Desktop node wallet key and its plain-text password from config.yaml and installs a backdoor on Windows, macOS, and Linux. The bee-js version sat on npm for about 75 minutes and ran as a postinstall script, while Swarm Desktop 0.56.2 was live on GitHub for about 8.5 hours and could reach Windows x64 and Apple Silicon Macs through the built-in updater within roughly 10 minutes.
Why it matters: Both packages carried valid provenance and a genuine Apple Developer ID signature because the project's real workflows built them, so the usual trust signals showed nothing wrong. The GitHub advisory states that any computer with bee-js 13.3.0 installed or running should be considered fully compromised, and withdrawing the releases removes neither an installed backdoor nor a key already sent.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026