Attackers compromise Ethersphere tools to steal wallet keys

Attackers exploited Ethersphere’s own release automation to push malicious builds of two tools used with Swarm’s decentralised storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. The posts run a loader that downloads extra code and then exfiltrates Swarm Desktop’s node wallet keys and the plaintext password stored in config.yaml, while also installing a backdoor on Windows, macOS, and Linux.

The bee-js release rides on npm’s postinstall script and was the latest npm version for about 75 minutes (13.3.0, from around 00:09 UTC to 01:25 UTC). Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC and was withdrawn roughly 8.5 hours later; its updater could affect Windows x64 and Apple Silicon Macs within about 10 minutes, while Intel Macs were never offered it and Linux updates did not occur automatically.

The bee-js and Swarm Desktop packages accepted version ranges that included 13.3.0, allowing a fresh install during the window to pull in the malicious code. The maintainers later issued a clean Swarm Desktop update: 0.56.3, which is the same code as 0.56.1 but signed with a new Developer ID certificate.

The project’s incident note attributes the breach to attackers using stolen CI credentials, describing two GitHub accounts used: bee-worker and a long-time maintainer’s account. The firm’s incident guidance notes that Bee-js 13.3.0 is considered fully compromised, with SafeDep confirming the same.

Evidence identified by Socket includes the loader’s origin at api.frameworkmetrics[.]xyz, and the attacker-controlled infrastructure and payloads, including two backdoors: a Go-based evjawbreaker on Linux/macOS and a legitimate ScreenConnect client on Windows, signed by ConnectWise, running as a system service.

Indicators of compromise include the domain api.frameworkmetrics[.]xyz, various loader URLs, Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, and the log paths and services noted in the cleaning guidance. Swarm Desktop’s update route and the updated signing flow are described in the incident notes, while the clean 0.56.3 release references the compromised 0.56.2 as published by an attacker using stolen CI credentials.

The article reports no total infected device count, but notes the bee-js 13.3.0 download was about 10 instances and Swarm Desktop 0.56.2 downloads reached 65 by 08:27 UTC, with researchers among the downloads.