Compromised bee-js 13.3.0 and Swarm Desktop 0.56.2 deliver wallet-stealing malware and a backdoor
Ethersphere's own release automation was abused to publish a malicious @ethersphere/bee-js 13.3.0 on npm and a malicious Swarm Desktop 0.56.2, both carrying the same loader and both pointing at the same attacker infrastructure. The bee-js payload runs as a postinstall script, so a plain install is enough and importing the library is not required. The payload takes the node's encrypted keystore (swarm.key) and its plain-text password (config.yaml), then installs the evjawbreaker Go backdoor on Linux and macOS and a ScreenConnect client on Windows. Both malicious releases were withdrawn and a clean Swarm Desktop 0.56.3 was published, but neither step removes a backdoor already installed or a key already sent. No theft of funds was reported at the time of writing, and no CVE is involved: the attackers used stolen CI credentials and the project's own signing and publishing workflows (github.com/ethersphere/swarm-desktop/issues/581).
Detalhes técnicos
- The bee-js 13.3.0 package was on npm from 00:09 to 01:25 UTC and was published with valid provenance, because the attackers triggered the project's real npm publishing workflow, which needed no approval (socket.dev as cited in the article).
- Swarm Desktop 0.56.2 appeared on GitHub at 00:36 UTC as an emergency patch release, about 30 minutes after the bee-js release (github.com/ethersphere/swarm-desktop/issues/581). The app's updater could offer it to Windows x64 and Apple Silicon users; Intel Macs and Linux auto-updates were not affected.
- The loader downloads further code from api.frameworkmetrics[.]xyz. In bee-js it runs at install time; in Swarm Desktop it runs at every app start.
- The downloaded code exfiltrates config.yaml and data-dir/keys/swarm.key to the attacker server, which exposes the node wallet's xDAI and xBZZ tokens, chequebook funds and stake.
- On Linux and macOS the backdoor is evjawbreaker, a Go remote shell kept in a hidden ~/.solidity folder and run as a systemd user service or a LaunchAgent. Its control server address is read from an Ethereum contract, which the operators can change at any time.
- On Windows the code installs a genuine, ConnectWise-signed ScreenConnect client as a system service. If the user is an administrator it bypasses UAC, adds a Microsoft Defender exclusion and installs silently.
- The Swarm Desktop build used the project's Apple Developer ID and Windows signing certificates, so macOS showed only its normal first-launch prompt.
- The payloads share infrastructure and file-naming patterns with fake Solidity developer extensions on Open VSX that Pluto Security described in October; the firm links them to the group behind SleepyDuck, though no group name is given in the article.
Remediação
- Search lockfiles, caches, internal registries and CI logs for @ethersphere/[email protected], including transitive copies. Pin 13.2.0 and clear cached 13.3.0 copies from any npm mirror.
- Treat any machine or CI runner that installed 13.3.0 with install scripts enabled as compromised, even when the log shows no errors.
- On Swarm Desktop, check bee-desktop.log for 'Bee Desktop version: 0.56.2 (production)'. Install 0.56.3, replacing the Linux package by hand. If 0.56.2 ever ran, treat the node key and password as stolen, and move funds, chequebook and stake to a new key from a clean machine.
- Rotate every password, token and key the installing user or CI job could read, from a clean machine.
- Remove ~/.solidity, the solidity-langsupport-runner.service unit (Linux), the com.solidity.langsupport.runner LaunchAgent (macOS) and the ScreenConnect Client (5cbe79c9c25524df) service (Windows). Updating or reinstalling does not remove these; rebuilding from a trusted image is preferred.
- Hunt for api.frameworkmetrics[.]xyz, the listed URL paths and the X-Ethersphere: 1 header, and for connections to 193[.]57[.]9[.]155:4912 and 185[.]232[.]84[.]169:8041.
Linha do tempo
-
Compromised bee-js 13.3.0 and Swarm Desktop 0.56.2 deliver wallet-stealing malware and a backdoor
ler a análise desta fonte ocultar
Ethersphere's own release automation was abused to publish a malicious @ethersphere/bee-js 13.3.0 on npm and a malicious Swarm Desktop 0.56.2, both carrying the same loader and both pointing at the same attacker infrastructure. The bee-js payload runs as a postinstall script, so a plain install is enough and importing the library is not required. The payload takes the node's encrypted keystore (swarm.key) and its plain-text password (config.yaml), then installs the evjawbreaker Go backdoor on Linux and macOS and a ScreenConnect client on Windows. Both malicious releases were withdrawn and a clean Swarm Desktop 0.56.3 was published, but neither step removes a backdoor already installed or a key already sent. No theft of funds was reported at the time of writing, and no CVE is involved: the attackers used stolen CI credentials and the project's own signing and publishing workflows (github.com/ethersphere/swarm-desktop/issues/581).
Technical Details
- The bee-js 13.3.0 package was on npm from 00:09 to 01:25 UTC and was published with valid provenance, because the attackers triggered the project's real npm publishing workflow, which needed no approval (socket.dev as cited in the article).
- Swarm Desktop 0.56.2 appeared on GitHub at 00:36 UTC as an emergency patch release, about 30 minutes after the bee-js release (github.com/ethersphere/swarm-desktop/issues/581). The app's updater could offer it to Windows x64 and Apple Silicon users; Intel Macs and Linux auto-updates were not affected.
- The loader downloads further code from api.frameworkmetrics[.]xyz. In bee-js it runs at install time; in Swarm Desktop it runs at every app start.
- The downloaded code exfiltrates config.yaml and data-dir/keys/swarm.key to the attacker server, which exposes the node wallet's xDAI and xBZZ tokens, chequebook funds and stake.
- On Linux and macOS the backdoor is evjawbreaker, a Go remote shell kept in a hidden ~/.solidity folder and run as a systemd user service or a LaunchAgent. Its control server address is read from an Ethereum contract, which the operators can change at any time.
- On Windows the code installs a genuine, ConnectWise-signed ScreenConnect client as a system service. If the user is an administrator it bypasses UAC, adds a Microsoft Defender exclusion and installs silently.
- The Swarm Desktop build used the project's Apple Developer ID and Windows signing certificates, so macOS showed only its normal first-launch prompt.
- The payloads share infrastructure and file-naming patterns with fake Solidity developer extensions on Open VSX that Pluto Security described in October; the firm links them to the group behind SleepyDuck, though no group name is given in the article.
Remediation
- Search lockfiles, caches, internal registries and CI logs for @ethersphere/[email protected], including transitive copies. Pin 13.2.0 and clear cached 13.3.0 copies from any npm mirror.
- Treat any machine or CI runner that installed 13.3.0 with install scripts enabled as compromised, even when the log shows no errors.
- On Swarm Desktop, check bee-desktop.log for 'Bee Desktop version: 0.56.2 (production)'. Install 0.56.3, replacing the Linux package by hand. If 0.56.2 ever ran, treat the node key and password as stolen, and move funds, chequebook and stake to a new key from a clean machine.
- Rotate every password, token and key the installing user or CI job could read, from a clean machine.
- Remove ~/.solidity, the solidity-langsupport-runner.service unit (Linux), the com.solidity.langsupport.runner LaunchAgent (macOS) and the ScreenConnect Client (5cbe79c9c25524df) service (Windows). Updating or reinstalling does not remove these; rebuilding from a trusted image is preferred.
- Hunt for api.frameworkmetrics[.]xyz, the listed URL paths and the X-Ethersphere: 1 header, and for connections to 193[.]57[.]9[.]155:4912 and 185[.]232[.]84[.]169:8041.