---
title: Attackers used Ethersphere's own release pipeline to ship a backdoored bee-js npm package and a signed, notarized Swarm Desktop update | ctxsec
url: https://ctxsec.com/items/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-release-pipeline-compromise-nov-9
description: "Socket says a threat actor holding two compromised GitHub accounts (a maintainer and the bee-worker release identity) pushed an unreviewed commit that turned @ethersphere/bee-js's version script into a postinstall loader, then published 13.3.0 through the project's legitimate npm trusted-publishing workflow, so the package carried genuine SLSA provenance. npm listed it as latest from 00:09 to 01:24 UTC on Nov 9, and GitHub issued GHSA-hh7j-5m3j-23pf. About 30 minutes later the same identity published Swarm Desktop 0.56.2 as an \"emergency patch release\" built, signed with the project's Developer ID and notarized by Apple in CI, and offered through the auto-updater to Apple Silicon and Windows x64 users for about eight and a half hours. Both loaders fetch JavaScript from api.frameworkmetrics[.]xyz and run it with full Node.js privileges; Socket says the next stage steals the Bee node's config.yaml (with its plaintext password) and wallet key, then installs a Go backdoor on macOS/Linux or a hidden ScreenConnect client on Windows. Socket links the C2 to the Ethereum contract used by the SleepyDuck/EtherDuck Open VSX campaign."
status: "research (Socket Threat Research, Nov 9) plus GitHub advisory GHSA-hh7j-5m3j-23pf; npm removed 13.3.0; attribution to the SleepyDuck/EtherDuck operator is Socket's assessment"
published: 2026-11-09
---

> Socket says a threat actor holding two compromised GitHub accounts (a maintainer and the bee-worker release identity) pushed an unreviewed commit that turned @ethersphere/bee-js's version script into a postinstall loader, then published 13.3.0 through the project's legitimate npm trusted-publishing workflow, so the package carried genuine SLSA provenance. npm listed it as latest from 00:09 to 01:24 UTC on Nov 9, and GitHub issued GHSA-hh7j-5m3j-23pf. About 30 minutes later the same identity published Swarm Desktop 0.56.2 as an "emergency patch release" built, signed with the project's Developer ID and notarized by Apple in CI, and offered through the auto-updater to Apple Silicon and Windows x64 users for about eight and a half hours. Both loaders fetch JavaScript from api.frameworkmetrics[.]xyz and run it with full Node.js privileges; Socket says the next stage steals the Bee node's config.yaml (with its plaintext password) and wallet key, then installs a Go backdoor on macOS/Linux or a hidden ScreenConnect client on Windows. Socket links the C2 to the Ethereum contract used by the SleepyDuck/EtherDuck Open VSX campaign.

[← Cybersecurity News](/news) · [markdown](/items/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-release-pipeline-compromise-nov-9.md)

research (Socket Threat Research, Nov 9) plus GitHub advisory GHSA-hh7j-5m3j-23pf; npm removed 13.3.0; attribution to the SleepyDuck/EtherDuck operator is Socket's assessment

2026-11-09

### Attackers used Ethersphere's own release pipeline to ship a backdoored bee-js npm package and a signed, notarized Swarm Desktop update

- **Affected:** `@ethersphere/bee-js@13.3.0` (npm) and Swarm Desktop 0.56.2 (GitHub release, now removed). Socket estimates about ten fetches of 13.3.0 and counted up to 65 downloads of 0.56.2, including researchers.
- **Fix (per Socket):** pin bee-js 13.2.0 and purge cached copies; replace Swarm Desktop 0.56.2 with 0.56.3. Deleting the release did not roll anyone back.
- **Assume theft:** on any machine that ran 0.56.2 or installed 13.3.0 with scripts enabled, treat the Bee node password and key as stolen and rotate credentials the user or CI job could reach, including cloud access via CI OIDC trust.
- **Why it matters beyond Swarm:** provenance and notarization were both genuine. They prove where something was built, not that the source was reviewed.

Sources: [Socket: Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor (Nov 9)](https://socket.dev/blog/bee-js-compromise) · [GitHub advisory GHSA-hh7j-5m3j-23pf: Malware in @ethersphere/bee-js (critical)](https://github.com/advisories/GHSA-hh7j-5m3j-23pf)