A threat actor used Ethersphere's own GitHub release automation to publish a malicious bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2. Both builds carry a loader that pulls remote code built to steal the wallet key a Swarm Desktop node keeps, together with the stored password that unlocks it, and to install a backdoor.

The npm package shipped through Ethersphere's legitimate trusted-publishing workflow with valid provenance, and npm removed it about 75 minutes after publication. The Swarm Desktop release stayed up for roughly eight and a half hours: the macOS build was signed and notarized, and the app's auto-updater offered it to Apple Silicon and Windows x64 users.

The later stages read their command server address from an Ethereum contract tied to the earlier SleepyDuck / EtherDuck campaign on Open VSX.

bee-js is the JavaScript client for Bee, the node software of the Swarm decentralized storage network, and averaged about 470 npm downloads a day in early November. Users who installed either version should remove it and rotate their node wallet keys.