Ethersphere has confirmed a supply-chain attack that compromised two of its Swarm-related tools—bee-js version 13.3.0 and Swarm Desktop version 0.56.2—to deliver wallet-stealing malware. Both malicious releases were pushed using the project’s own release automation and have since been removed. However, any private keys or passwords already accessed may remain exposed. Neither tool’s users have reported loss of funds so far.
What Were Compromised
bee-js is the JavaScript library underpinning the Swarm Desktop app and the swarm-cli command-line tool. Swarm Desktop allows users to run a Swarm node locally and stores key files on the user’s device. In the compromised versions, both tools were crafted to harvest the wallet private key that Swarm Desktop maintains, along with the plaintext password that unlocks it. Additionally, the attackers introduced a persistent backdoor for Windows, macOS, and Linux.
The malicious Swarm Desktop 0.56.2 release appeared around 00:36 UTC and was taken down about 8½ hours later. It could be pushed to users via the app’s built-in updater on Windows (x64) and Apple Silicon Macs within approximately ten minutes. Linux users were not automatically updated. The bee-js 13.3.0 release was live on npm from about 00:09 to 01:25 UTC, and was pulled after roughly 75 minutes. Projects importing bee-js—or other tools that accept version ranges including 13.3.0—could have unintentionally fetched the malicious package.
Impact, Remediation & What to Do Now
The developers have released clean Swarm Desktop version 0.56.3, restoring the previous stable release (0.56.1) codebase and signing it with a new Developer ID certificate. Automatic updates will migrate users from 0.56.2 to 0.56.3 on supported platforms; Linux users must replace the software manually. On npm, bee-js has been rolled back to version 13.2.0 and 13.3.0 is no longer available.
Anyone who installed or ran bee-js 13.3.0, or Swarm Desktop 0.56.2, should assume that private keys and passwords are compromised. Projects using bee-js should search for version 13.3.0 across lockfiles, internal registries, cached packages, and CI logs, and pin dependencies to 13.2.0. Users of Swarm Desktop must install version 0.56.3, or manually replace the package on Linux systems. If 0.56.2 ever ran, funds, stakes, chequebooks, and private keys should be moved to a fresh wallet, with passwords rotated, and machines rebuilt from clean images wherever possible.
The malware’s behavior, as analyzed by security firms, included downloading additional code from a remote server, sending key files (config.yaml and swarm.key) to the attacker, and silently installing backdoor agents: a Go-based remote shell (“evjawbreaker”) on Linux/macOS, and a ScreenConnect remote client on Windows. Windows versions also exploited a UAC bypass to grant administrator rights, added exclusions in Microsoft Defender, and operated stealthily as a system service.
How It Happened: CI Compromise & Workflow Weaknesses
The breach stems from an attacker gaining control of Ethersphere’s bee-worker account, which handles automated releases. In both cases, release workflows were triggered without human review, using stolen continuous integration (CI) credentials. The bear-worker account published the malicious versions, and signing workflows for Swarm Desktop used valid Developer ID certificates. Vulnerability auditors emphasize that valid provenance (meaning the releases came through official workflows) does not guarantee that code is safe.
The attackers are likely linked to a group that previously used fake VS Code extensions targeting Solidity developers, and cryptocurrency contracts, suggesting a recurring threat actor investing in Ethereum-adjacent supply chain tools.
Indicators of Compromise are now public, including domain names (e.g. api.frameworkmetrics[.]xyz), specific HTTP paths used by the malware, IP addresses for control servers, filenames, service names for persistence, and file hashes for different platforms. Security teams are urged to use these to detect infection.
What This Means
Ethersphere’s incident is another wake-up call about the fragility of open-source supply chains: even upstream tools that seem innocuous—libraries like bee-js or desktop helpers—can become vectors for high-impact security breaches.
Developers and users should assume credentials guarding CI/CD pipelines and automated release accounts are as sensitive as private keys. Zero trust principles and multi-person approvals for release and signing workflows should be non-negotiable. For end users of Swarm tools, checking logs, restoring from clean software, and relocating crypto assets where compromise is suspected will be vital. This attack shows that integrity alone isn’t enough; persistent vigilance across tooling infrastructure matters now more than ever.
