Skip to content
securitytabs

Covered by 2 outlets — first reported by Socket Blog, Nov 9, 14:52 UTC

Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

MentionsGitHub

Summary

Socket says an attacker compromised the release pipeline of the Ethersphere project on November 9, 2026, using its own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 on npm and a trojanized Swarm Desktop 0.56.2 on GitHub. The Hacker News reports both releases run code built to steal the wallet key Swarm Desktop keeps for its node and the password that unlocks it, and to install a backdoor.

AI summary by the SecurityTabs newsroom, checked against Socket Blog, The Hacker News. Read the outlets below for the full story.

Continue reading

2 outlets, in the order they reported it.

  1. Socket BlogFirst report

    Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

    Socket’s Threat Research Team analyzed the November 9, 2026 compromise of Ethersphere’s release pipeline, in which a threat actor used the project’s own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a…

    Read at Socket Blog Details

  2. The Hacker News

    Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

    Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.

    Read at The Hacker News Details

Explained

The technology and terms in this story. Learn more