On November 9, hackers seized control of Ethersphere's software release system and used it to push malware through bee-js 13.3.0 — Ethersphere's JavaScript client library for the Swarm decentralized storage network — and Swarm Desktop 0.56.2, the desktop application for running Bee nodes. The malicious code was built to hunt for Bee node wallet private keys, giving the attackers access to affected devices. The tainted bee-js package stayed on npm, the main registry for JavaScript packages, for roughly 75 minutes, while the compromised Swarm Desktop release remained online for nearly eight and a half hours.

Signed, provenanced, and still malicious

The breach was particularly concerning because the malicious software appeared legitimate. Cybersecurity firm Socket confirmed that bee-js carried valid SLSA provenance — the Supply-chain Levels for Software Artifacts framework, which documents how a build was produced — while Swarm Desktop's macOS installer had been signed and Apple-notarized, with auto-update support for Apple Silicon and Windows users. Those checks verified the software's origin, but not its safety.

The attackers inserted malicious code into trusted workflows. Socket linked the incident to compromised GitHub accounts, including the release bot bee-worker, though how that access was obtained remains unknown.

What the loader steals

StepSecurity found that the attackers modified scripts/generate-version.cjs to download malicious code from api.frameworkmetrics[.]xyz. The script ran automatically when developers installed bee-js 13.3.0, even if they never used the library.

The malware then searched for two files: config.yaml and data-dir/keys/swarm.key. The first contained the password needed to unlock the encrypted wallet key stored in the second. With both in hand, attackers could take control of a Bee node wallet.

The malware also installed backdoors to maintain remote access. On Windows, it deployed ScreenConnect, a commercial remote-access tool; on Linux and macOS, the backdoors disguised themselves as legitimate Solidity development tools.

The same wallet behind SleepyDuck

Socket found that the malware used Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 to locate its command-and-control servers. Pluto Security had previously tied the same contract to the SleepyDuck and EtherDuck campaigns, which spread malware through fake Solidity extensions.

This time, however, the attackers took a different route: compromising Ethersphere's authentic software releases rather than luring developers into downloading fakes. The technique resembles a previous npm supply-chain attack reported by Cryptopolitan, in which hackers distributed malware through Arweave's WeaveDB project packages.

What operators need to do now

In two official notices (1, 2), Ethersphere identified both releases as malicious. Maintainer darkobas2 stated in a recovery pull request that 0.56.2 "was built and published by an attacker using stolen CI credentials." The clean replacement, 0.56.3, was "same code as 0.56.1," signed with a new certificate.

Users should check their Desktop version and install 0.56.3; Linux users must update manually. Anyone who ran the malware should isolate and rebuild the machine, move funds and stake from a clean device, and rotate credentials. bee-js users should pin 13.2.0, since an update alone will not remove a backdoor.

Socket recorded 65 downloads of the tainted Desktop release by 08:27 UTC on November 9, including researchers, and estimated about ten fetches of bee-js 13.3.0. Neither figure is a victim count, and no confirmed tally of infected machines or stolen funds exists. Two details remain worth watching as the recovery continues: how the attackers obtained access to the release infrastructure, and whether any confirmed losses emerge.

Industry-wide context

On CertiK's dashboard, wallet compromise ranks second by 2026 losses ($769.1 million) and third by incidents (75). Private-key compromise ranks fifth by losses ($158 million) and fourth by incidents (47). Those figures are industry-wide, not Ethersphere-specific.

CoinGecko priced BZZ near $0.0654 on November 10, but no breach-driven selloff has been established. The broader warning concerns software trust: even authentic-looking updates can steal keys.