bee-js

Ethersphere's bee-js and Swarm Desktop Hit by Supply Chain Attack Delivering Wallet-Stealing Malware

Attackers compromised Ethersphere's automated release processes to publish malicious versions of bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 on GitHub. The packages used postinstall scripts and startup routines to download a loader from api.frameworkmetrics[.]xyz that exfiltrated Swarm node wallet keys and plaintext passwords while installing persistent backdoors. The bee-js package remained available for roughly 75 minutes and was pulled by dependent projects including swarm-cli and bee-dashboard, while Swarm Desktop 0.56.2 reached automatic update channels on Windows and Apple Silicon Macs. Maintainers later confirmed the releases originated from the bee-worker CI account using stolen credentials and responded by revoking certificates and requiring manual approval for future signing workflows. No fund thefts had been reported at publication time, yet both Socket and SafeDep advise treating any affected system as fully compromised. The campaign reuses infrastructure previously linked to fake Solidity extensions on Open VSX and the SleepyDuck group.