Title: Ethersphere’s bee-js and Swarm Desktop Hit by Supply Chain Attack That Steals Node Wallets
Summary: The Swarm ecosystem took a hit in its own pipeline: two artifacts — the npm client bee-js 13.3.0 and the Swarm Desktop 0.56.2 build — shipped with a code loader attached after an attacker drove the release workflows using stolen CI credentials. The maintainer’s incident note says 0.56.2 “was published by an attacker using stolen CI credentials and has been withdrawn.” Both releases carry the same small loader, which downloads further code from api.frameworkmetrics.xyz and runs it with the user’s permissions. That code grabs two files from Swarm Desktop’s data folder — config.yaml, which stores the node password in plain text, and data-dir/keys/swarm.key, an encrypted Ethereum keystore — and sends them to the attacker’s server, opening the way to the node wallet’s xDAI and xBZZ funds, chequebook and stake. It also installs persistence: on Linux and macOS a Go remote shell called evjawbreaker in a hidden ~/.solidity folder, running as the solidity-langsupport-runner.service user service on Linux and a com.solidity.langsupport.runner LaunchAgent on macOS; on Windows a genuine signed ScreenConnect client as a system service, silently installed with a Microsoft Defender exclusion once admin rights are obtained. The C2 address is read from an Ethereum smart contract. The window was narrow: bee-js 13.3.0 sat on npm as the latest version for about 75 minutes (00:09–01:25 UTC on November 9) and its postinstall script ran without the project importing it; the Socket estimate is roughly 10 downloads. Swarm Desktop 0.56.2 appeared about 00:36 UTC, was offered by the built-in updater on Windows x64 and Apple Silicon only (Linux installs never auto-update), and reached about 65 downloads before withdrawal. Because both builds came from the project’s real workflows with no approval step, the npm package carried valid provenance, and the macOS build came code-signed under the project’s Developer ID plus Apple notarization. Cleanup matters regardless of the takedowns: any machine that ran the code should be treated as fully compromised — pin bee-js 13.2.0 and purge 13.3.0 from caches and registries; check Swarm Desktop’s bee-desktop.log for “Bee Desktop version: 0.56.2”; install the clean 0.56.3 release (same code as 0.56.1, re-signed), replacing Linux packages by hand; rotate every credential the installing user could read and move node funds, chequebook and stake to a new key from a clean machine; and remove the ~/.solidity folder plus the user service, LaunchAgent, or ScreenConnect Client (5cbe79c9c25524df) service, which reinstalling the app does not touch. Ethersphere’s incident note did not confirm any funds had actually moved by the time it was published.
References: