On November 9, 2026, the Ethersphere release pipeline was compromised, resulting in the distribution of malicious versions of the bee-js npm package (version 13.3.0) and the Swarm Desktop application (version 0.56.2). The breach occurred through the project's automated workflow, likely via the bee-worker bot or stolen CI credentials.
The malicious software utilized postinstall hooks to automatically download secondary payloads upon installation. These payloads targeted Swarm node wallet files, specifically config.yaml and swarm.key, to exfiltrate Ethereum keystores and plaintext passwords. The objective was to drain xDAI and xBZZ tokens, as well as stake and chequebook funds.
The malware also established persistent backdoors on affected systems. Security advisories indicate that any machine running these specific versions should be considered fully compromised. The attack has been linked to the infrastructure previously associated with the SleepyDuck campaign.
Ethersphere has advised users to remove backdoors and immediately rotate their wallet keys. Simply updating the software is insufficient, as exposed keys remain vulnerable and persistent access mechanisms may still be active. Developers are urged to conduct dependency audits and review lockfiles.
