Hackers Poison Ethersphere Releases With Wallet-Stealing Malware

Ethersphere's automated release process was hijacked on November 9, 2026, according to Crypto Briefing, producing two malicious builds: bee-js version 13.3.0 and Swarm Desktop version 0.56.2. The npm package rolled out around 00:09 UTC, with the desktop app following roughly 27 minutes later. Attackers didn't break in through a side door — they rode the legitimate release workflow, using either the bee-worker bot or stolen CI credentials.

Both releases carried postinstall hooks, scripts that fire the instant a package is installed. Those hooks called out to an attacker-controlled server and pulled down extra payloads, so installing bee-js was effectively the same as running the attacker's code. The payloads then searched for sensitive Swarm node wallet files, specifically config.yaml and data-dir/keys/swarm.key.

That second file holds an encrypted Ethereum keystore — but the password to unlock it sat in plaintext right next to it. Stolen files were exfiltrated, and the objective was to drain xDAI and xBZZ tokens plus chequebook funds and stake tied to Swarm nodes. The malware also planted persistent backdoors, keeping attackers inside compromised systems across multiple platforms. GitHub advisory GHSA-hh7j-5m3j-23pf didn't mince words: any machine that installed the compromised package should be treated as 'fully compromised.'

Ethereum Swarm took to Discord to push users into action — secure systems, replace the affected desktop release, strip out the backdoors, and swap wallet keys. The key swap is the part that matters most: if an attacker already has a copy of the keystore and its password, patching the software protects nothing sitting behind those keys. Upgrading to a clean version alone won't cut it.

The attack leaned on infrastructure linked to a previous malware operation called the SleepyDuck campaign. Developers who bundle bee-js into their own projects may have a wider problem on their hands, since a bad dependency can turn a build server or a teammate's laptop into an entry point. Ethersphere's next test is explaining the root cause and making sure one compromised pipeline can never ship malware again.