Attackers Seize Swarm Release Pipeline, Deploy Wallet Malware

Attackers compromised Ethersphere’s release automation to push malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2. The bee-js library circulated on npm for 75 minutes while Swarm Desktop’s malicious build stayed live for 8.5 hours. Download counts remained modest—roughly 10 for bee-js and 65 for Swarm Desktop—with no confirmed fund theft reported.

Both releases contained identical malware that steals wallet keys and passwords from Swarm node configurations. The code downloads a loader that extracts an encrypted key file and plaintext password stored by Swarm Desktop, granting attackers access to node funds and cryptocurrency stakes. Windows systems receive a legitimate ScreenConnect remote-access client installed as a system service, while Linux and macOS get evjawbreaker, a Go remote shell that reads its command-and-control address from an Ethereum smart contract, allowing dynamic server updates.

The attackers obtained CI credentials and used Ethersphere’s bee-worker automation account to publish unsigned releases that bypassed approval requirements—npm published bee-js in 73 seconds. Swarm Desktop’s build workflow similarly required no authorization before signing and notarizing with the project’s certificates. Maintainers removed both releases, published clean versions, and now mandate DevOps approval for signing operations, though how the initial credential theft occurred remains unexplained.