Attackers used Ethersphere's own release pipeline to ship a backdoored bee-js npm package and a signed, notarized Swarm Desktop update
- Affected:
@ethersphere/bee-js@13.3.0(npm) and Swarm Desktop 0.56.2 (GitHub release, now removed). Socket estimates about ten fetches of 13.3.0 and counted up to 65 downloads of 0.56.2, including researchers. - Fix (per Socket): pin bee-js 13.2.0 and purge cached copies; replace Swarm Desktop 0.56.2 with 0.56.3. Deleting the release did not roll anyone back.
- Assume theft: on any machine that ran 0.56.2 or installed 13.3.0 with scripts enabled, treat the Bee node password and key as stolen and rotate credentials the user or CI job could reach, including cloud access via CI OIDC trust.
- Why it matters beyond Swarm: provenance and notarization were both genuine. They prove where something was built, not that the source was reviewed.
Sources: Socket: Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor (Nov 9) · GitHub advisory GHSA-hh7j-5m3j-23pf: Malware in @ethersphere/bee-js (critical)