Ethersphere Release Pipeline Compromised, Spreading Malicious bee-js and Swarm Desktop

Ethersphere, the developer of the decentralized storage network Swarm, suffered a software supply chain attack. Attackers exploited the project's GitHub release workflow to publish the compromised JavaScript library bee-js 13.3.0 to NPM and release Swarm Desktop 0.56.2. The malware attempts to extract Swarm node wallet keys and configuration files containing unlock passwords, transmitting them to attackers while deploying operating-system-specific remote backdoors. According to Ethersphere's GitHub remediation logs and findings by security firm Socket, attackers compromised maintainer accounts and CI credentials, utilizing the compromised bee-worker account. Because the automated pipeline lacked branch protection checks and bypassed tests on GitHub releases, malicious packages were deployed via official GitHub Actions with valid provenance, and the macOS version of Swarm Desktop even passed Apple notarization. bee-js 13.3.0 was removed from NPM approximately 75 minutes after release, and Swarm Desktop 0.56.2 was withdrawn about eight and a half hours after publication. Ethersphere has released clean Swarm Desktop 0.56.3, advising bee-js users to revert to 13.2.0. Users who ran affected versions are advised to inspect their systems for backdoors and rotate exposed keys and credentials.

Key takeaways

• Attackers used compromised CI credentials and maintainer accounts through GitHub Actions pipelines lacking branch protection checks.
• bee-js 13.3.0 leveraged a postinstall script to download external code, targeting node keys and establishing backdoors.
• Swarm Desktop 0.56.2 was infected, abusing ScreenConnect on Windows and deploying a Go-based backdoor on macOS and Linux.
• The affected versions have been removed; Ethersphere released Swarm Desktop 0.56.3 and advised users to rotate credentials.