Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet keys and install evjawbreaker and ScreenConnect backdoors

Linha do tempo

1. thehackernews.com ↗ · pub. 09/11/2026 14:36 · coletado 09/11 17:00

   Compromised bee-js 13.3.0 and Swarm Desktop 0.56.2 deliver wallet-stealing malware and a backdoor

   ler a análise desta fonte ocultar

   Ethersphere's own release automation was abused to publish a malicious @ethersphere/bee-js 13.3.0 on npm and a malicious Swarm Desktop 0.56.2, both carrying the same loader and both pointing at the same attacker infrastructure. The bee-js payload runs as a postinstall script, so a plain install is enough and importing the library is not required. The payload takes the node's encrypted keystore (swarm.key) and its plain-text password (config.yaml), then installs the evjawbreaker Go backdoor on Linux and macOS and a ScreenConnect client on Windows. Both malicious releases were withdrawn and a clean Swarm Desktop 0.56.3 was published, but neither step removes a backdoor already installed or a key already sent. No theft of funds was reported at the time of writing, and no CVE is involved: the attackers used stolen CI credentials and the project's own signing and publishing workflows (github.com/ethersphere/swarm-desktop/issues/581).

   Technical Details

   • The bee-js 13.3.0 package was on npm from 00:09 to 01:25 UTC and was published with valid provenance, because the attackers triggered the project's real npm publishing workflow, which needed no approval (socket.dev as cited in the article).
   • Swarm Desktop 0.56.2 appeared on GitHub at 00:36 UTC as an emergency patch release, about 30 minutes after the bee-js release (github.com/ethersphere/swarm-desktop/issues/581). The app's updater could offer it to Windows x64 and Apple Silicon users; Intel Macs and Linux auto-updates were not affected.
   • The loader downloads further code from api.frameworkmetrics[.]xyz. In bee-js it runs at install time; in Swarm Desktop it runs at every app start.
   • The downloaded code exfiltrates config.yaml and data-dir/keys/swarm.key to the attacker server, which exposes the node wallet's xDAI and xBZZ tokens, chequebook funds and stake.
   • On Linux and macOS the backdoor is evjawbreaker, a Go remote shell kept in a hidden ~/.solidity folder and run as a systemd user service or a LaunchAgent. Its control server address is read from an Ethereum contract, which the operators can change at any time.
   • On Windows the code installs a genuine, ConnectWise-signed ScreenConnect client as a system service. If the user is an administrator it bypasses UAC, adds a Microsoft Defender exclusion and installs silently.
   • The Swarm Desktop build used the project's Apple Developer ID and Windows signing certificates, so macOS showed only its normal first-launch prompt.
   • The payloads share infrastructure and file-naming patterns with fake Solidity developer extensions on Open VSX that Pluto Security described in October; the firm links them to the group behind SleepyDuck, though no group name is given in the article.

   Remediation

   • Search lockfiles, caches, internal registries and CI logs for @ethersphere/[email protected], including transitive copies. Pin 13.2.0 and clear cached 13.3.0 copies from any npm mirror.
   • Treat any machine or CI runner that installed 13.3.0 with install scripts enabled as compromised, even when the log shows no errors.
   • On Swarm Desktop, check bee-desktop.log for 'Bee Desktop version: 0.56.2 (production)'. Install 0.56.3, replacing the Linux package by hand. If 0.56.2 ever ran, treat the node key and password as stolen, and move funds, chequebook and stake to a new key from a clean machine.
   • Rotate every password, token and key the installing user or CI job could read, from a clean machine.
   • Remove ~/.solidity, the solidity-langsupport-runner.service unit (Linux), the com.solidity.langsupport.runner LaunchAgent (macOS) and the ScreenConnect Client (5cbe79c9c25524df) service (Windows). Updating or reinstalling does not remove these; rebuilding from a trusted image is preferred.
   • Hunt for api.frameworkmetrics[.]xyz, the listed URL paths and the X-Ethersphere: 1 header, and for connections to 193[.]57[.]9[.]155:4912 and 185[.]232[.]84[.]169:8041.
2. safedep.io ↗ · pub. 08/11/2026 21:00 · coletado 09/11 05:00 primeiro registro

   Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet keys and install backdoors

   ler a análise desta fonte ocultar

   A malicious @ethersphere/bee-js 13.3.0 release reached npm at 00:09 UTC on 2026-11-09 with a valid provenance attestation and runs attacker code from a new postinstall hook on every install. The second stage steals the Swarm node wallet key files from Swarm Desktop and installs a backdoor that survives reboots: the evjawbreaker Go remote shell on Linux and macOS, and a hidden ScreenConnect client running as SYSTEM on Windows. The same loader was added to Swarm Desktop 0.56.2, published about 30 minutes later under the project's release bot account (bee-worker). npm removed 13.3.0 and points latest back to 13.2.0, the last clean version. Severity is critical because the code runs at install time with no interaction beyond the install, the stolen keys control funds, and the backdoors grant full remote control. Exposure is bounded to machines that installed 13.3.0 or Swarm Desktop 0.56.2, and the payload is only served when a specific header is sent, otherwise a decoy is returned.

   Technical Details

   The malicious commit de2f74e was pushed to the upcoming branch at 23:59:54 UTC on 2026-11-08 under the bee-worker identity, with no signature and no pull request (github.com/ethersphere/bee-js). It changed the package.json prepare hook to postinstall and added scripts to the files list so the script ships in the package. The release was published through the project's publish_npmjs.yaml workflow, which runs tests only for branch pushes and therefore ran none. The postinstall script sends a request to api.frameworkmetrics.xyz with an X-Ethersphere header that unlocks the real payload, and it silently ignores errors and timeouts.

   The stage-2 payload is per-OS JavaScript that reads config.yaml and data-dir/keys/swarm.key from the Swarm Desktop data folder and posts both to /v1/swarm/report. The swarm.key file is an encrypted Ethereum keystore, and config.yaml holds its password in plain text, which gives the attacker the node private key and access to the xDAI, xBZZ, chequebook funds and stake. On Linux, a systemd unit is kept repaired on each run.

   The evjawbreaker implant for Linux and macOS connects to a hub over TLS without certificate checks and runs sh in a pseudo-terminal. It has no hard-coded server: it reads the hub address from the Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 through public RPC endpoints. The operator deployed that contract on 2026-03-14, has pointed it to seven hubs, and set the current hub 193.57.9.155:4912 at 23:30 UTC on 8 Nov.

   On Windows, an obfuscated invoke.ps1 obtains admin rights through UACMe method 39, which hijacks the .NET profiler of mmc.exe, adds a Defender exclusion, silently installs app.msi and then removes the exclusion and staging files. The app.msi is a legitimate ScreenConnect 25.4.3 client signed by ConnectWise, reconfigured to relay through 185.232.84.169:8041, hide its UI and start sessions without consent, and run as a SYSTEM service. The relay and the current evjawbreaker hub are both hosted by Onidel in the Netherlands.

   Swarm Desktop 0.56.2 (commit 2de7270, no signature, no pull request) adds the same loader to the main() function, which calls /v1/electron at each app start. The amd64 .deb carries the loader in app.asar, and the other installers from the same build probably do too.

   Fix Details

   For Swarm Desktop, pull request #582 (github.com/ethersphere/swarm-desktop/pull/582) was opened by darkobas2 to replace the compromised release. It was merged on 2026-11-09 and is an empty commit on top of v0.56.1 with a Release-As: 0.56.3 footer, so release-please cuts 0.56.3, described as the same code as 0.56.1 signed with a newly issued Developer ID certificate. The PR states that the auto-updater will move installs of the malicious 0.56.2 to 0.56.3; the published 0.56.3 release was not verified during this research. For @ethersphere/bee-js no fix pull request was located; the fix is the registry reverting latest to 13.2.0 (ox.security).

   Remediation

   • Treat any machine that installed @ethersphere/bee-js 13.3.0 or Swarm Desktop 0.56.2 as compromised.
   • Pin @ethersphere/bee-js to 13.2.0 and regenerate every lockfile that resolved 13.3.0, including transitive dependencies (ostorlab.co).
   • Move the Swarm node funds and stake to a new key and treat the old key as stolen.
   • Remove the backdoor: the ~/.solidity/ folder and its systemd unit or LaunchAgent, or the ScreenConnect Client (5cbe79c9c25524df) service on Windows.
   • Block api.frameworkmetrics.xyz, the relay 185.232.84.169:8041 and the hub 193.57.9.155:4912, and hunt for the swarm.key and config.yaml reads.
   • Do not rely on ScreenConnect file hashes, which are legitimate; detect the relay address, the service instance ID and the configuration hashes instead.

   Conflicting Reports

   The article attributes the bee-js release to a compromised bot account or token rather than a stolen npm token. OX Security describes a suspected compromised developer access key (ox.security). The Swarm Desktop PR #582 says v0.56.2 was published by an attacker using stolen CI credentials and has been withdrawn (github.com/ethersphere/swarm-desktop/pull/582). The article reports 0.56.2 as still the current GitHub release at 06:58 UTC on 9 Nov; the repository's withdrawal of that release is the more recent and authoritative status.