Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
MentionsGitHub
Socket’s Threat Research Team analyzed the November 9, 2026 compromise of Ethersphere’s release pipeline, in which a threat actor used the project’s own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub.
Summary from Socket Blog.
Explained
The technology and terms in this story. Learn more
- TechnologynpmThe package registry for JavaScript: millions of open-source libraries that projects install automatically.
- ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
Related coverage
Other sources covering the same vulnerabilities or event.