On November 9, 2026, the software distribution pipeline of Ethersphere was hijacked, allowing attackers to push malicious versions of the bee‑js library (v13.3.0) and the Swarm Desktop client (v0.56.2). The compromised packages were signed and appeared legitimate, leading to the theft of private keys from Bee node wallets and the installation of persistent backdoors on affected machines.

ETH / USD
Source: CoinGecko. Prices are indicative.

How the supply‑chain breach unfolded

According to cybersecurity firm Socket, the attackers gained access to compromised GitHub accounts, including the release bot bee‑worker, and altered the build script scripts/generate-version.cjs. The modified script fetched additional code from a malicious domain (api.frameworkmetrics.xyz) during installation, even if developers never invoked the library directly. The malware then scanned the host for two files—config.yaml and data-dir/keys/swarm.key—using the password stored in the former to decrypt the private key in the latter. With both files, the hackers could fully control a Bee node wallet.

Backdoors and command‑and‑control infrastructure

The payload installed different remote‑access tools depending on the operating system: ScreenConnect on Windows, and tools masquerading as Solidity development utilities on macOS and Linux. Socket traced the command‑and‑control traffic to Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, previously linked by Pluto Security to the SleepyDuck and EtherDuck campaigns. Unlike those earlier attacks, which relied on fake extensions, this breach leveraged authentic Ethersphere releases to reach users.

Response and remediation steps

Ethersphere issued two official notices confirming the malicious nature of the releases. Maintainer darkobas2 explained that Swarm Desktop 0.56.2 was built with stolen CI credentials and released a clean version (0.56.3) signed with a new certificate. Linux users must apply the update manually, while macOS and Windows users can rely on the auto‑update mechanism. Bee‑js users are advised to pin the package to version 13.2.0. Socket recorded 65 downloads of the tainted Swarm Desktop binary and roughly ten fetches of bee‑js 13.3.0 before the packages were removed, though no definitive victim count or stolen‑funds figure has been released.

What to watch next

Analysts will monitor whether compromised wallets are moved to known laundering addresses, and whether any large‑scale fund outflows from BZZ or related staking contracts occur. Further investigation into the initial GitHub credential compromise may reveal additional supply‑chain risks for other Ethereum tooling ecosystems.