Science & Tech · Cybersecurity · 8 hrs ago
Ethersphere tools compromised to spread wallet-stealing malware
Attackers used Ethersphere’s release system to publish malicious versions of bee-js and Swarm Desktop.
The tools are used with Swarm, a decentralized storage network, and Swarm Desktop stores private keys for a node on the user’s computer.
The malicious code was designed to steal wallet keys and the passwords that unlock them.
It also installs backdoors on Windows, macOS and Linux computers.
The attackers used stolen credentials for the project’s automated build system, allowing the releases to pass security checks.
Ethersphere removed the affected versions and released a clean Swarm Desktop update, but an update does not remove an installed backdoor.
No theft of funds had been reported, and users whose machines ran the affected software are advised to rotate exposed credentials and rebuild those systems cleanly.
Attackers used Ethersphere’s release automation to publish malicious versions of bee-js and Swarm Desktop.
The releases, bee-js 13.3.0 and Swarm Desktop 0.56.2, were designed to steal wallet keys and passwords and install backdoors.
The attackers used stolen continuous integration credentials, according to the project’s maintainer.
Both releases were withdrawn, and Ethersphere released a clean Swarm Desktop update, but those steps do not remove existing infections or recover keys already sent.
No theft of funds had been reported at the time of The Hacker News article.
- Who
- Attackers compromised Ethersphere’s release process. The targeted tools were used by Swarm network users.
- What
- Malicious releases of bee-js and Swarm Desktop were published to steal wallet keys and passwords and install backdoors.
- When
- The affected releases appeared on November 9, 2026. The articles were published on November 9 and 10, 2026.
- Where
- The releases were distributed through npm and GitHub.
- Why
- The code was designed to steal sensitive wallet keys and passwords.
This story does not have two clearly opposing sides.
bee-js 13.3.0 became the latest version on npm.
Swarm Desktop 0.56.2 appeared on GitHub.
bee-js 13.3.0 was no longer the latest version on npm.
Swarm Desktop 0.56.2 was withdrawn.
Ethersphere’s maintainers released clean Swarm Desktop version 0.56.3.
- Affected bee-js release
- Version 13.3.0
- Affected Swarm Desktop release
- Version 0.56.2
- Clean Swarm Desktop release
- Version 0.56.3
- bee-js listing period
- About 75 minutes, from 00:09 to 01:25 UTC
- Swarm Desktop download count
- 65 by 08:27 UTC, including researchers
2 sources
What people are saying
was published by an attacker using stolen CI credentials and has been withdrawn.
Any computer that has this package installed or running should be considered fully compromised.