---
title: Hunt: frameworkmetrics[.]xyz loader, ~/.solidity persistence and a hidden ScreenConnect client from the bee-js / Swarm Desktop compromise | ctxsec
url: https://ctxsec.com/items/hunt-bee-js-swarm-desktop-sleepyduck-frameworkmetrics-solidity-persistence
description: "Socket published network, file and persistence indicators for the Nov 9 Ethersphere compromise and says the Ethereum-contract lookup flags the backdoor whether it arrived through npm, Swarm Desktop or the earlier Open VSX extensions."
status: "IOCs and hunt leads from Socket Threat Research (Nov 9)"
published: 2026-11-09
---

> Socket published network, file and persistence indicators for the Nov 9 Ethersphere compromise and says the Ethereum-contract lookup flags the backdoor whether it arrived through npm, Swarm Desktop or the earlier Open VSX extensions.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-bee-js-swarm-desktop-sleepyduck-frameworkmetrics-solidity-persistence.md)

IOCs and hunt leads from Socket Threat Research (Nov 9)

2026-11-09

### Hunt: frameworkmetrics[.]xyz loader, ~/.solidity persistence and a hidden ScreenConnect client from the bee-js / Swarm Desktop compromise

- **DNS/proxy:** `api[.]frameworkmetrics[.]xyz` (paths `/v1/analytics`, `/v1/electron`, `/v1/swarm/report`); hub `193[.]57[.]9[.]155:4912` and earlier hubs on port 4912; ScreenConnect relay `185[.]232[.]84[.]169:8041`.
- **RPC:** `eth_call` to contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` with data `0x02d91518`, especially from binaries under `~/.solidity/`.
- **Persistence:** `~/.solidity/`, LaunchAgent `com.solidity.langsupport.runner`, systemd user unit `solidity-langsupport-runner.service`, Windows service `ScreenConnect Client (5cbe79c9c25524df)`. Reinstalling the app does not remove them.
- **Logs:** `Bee Desktop version: 0.56.2 (production)` in `bee-desktop.log`; npm install-script warnings naming `@ethersphere/bee-js@13.3.0 (postinstall: node scripts/generate-version.cjs)`.
- **Hashes:** Swarm Desktop 0.56.2 `dist/desktop/src/index.js` SHA-256 `f81315968e679b48f6bdff1c9b928bb223230d07f44d7948412c2250c2a14deb`; `bee-js-13.3.0.tgz` `d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58`. Full list in Socket's post.

Sources: [Socket: Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor (Nov 9)](https://socket.dev/blog/bee-js-compromise)