Attackers published trojanized versions of Ethersphere’s bee-js npm package and the Swarm Desktop application on Monday, November 9, aiming to steal Ethereum keystores and install persistent remote access on developer machines. Researchers at Socket and SafeDep found the releases and linked them to a group called SleepyDuck.
Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 Releases
The malicious bee-js 13.3.0 was the latest version on npm for about 75 minutes, from 00:09 to 01:25 UTC. Swarm Desktop 0.56.2 appeared at about 00:36 UTC and stayed available for roughly 8.5 hours before it was pulled.
Maintainers have since released a clean Swarm Desktop 0.56.3. The short npm window limits the number of installs of the package, but the desktop application remained available far longer.
How the Loader Pulls Code From api.frameworkmetrics.xyz
The compromised releases include a loader that fetches additional code from the domain api.frameworkmetrics[.]xyz. That code targets Swarm Desktop configuration files and steals encrypted Ethereum keystores along with plaintext passwords stored there. With both in hand, an attacker can access the wallet and move tokens and chequebook funds out of the victim’s control.
Second Stage Installs evjawbreaker and ScreenConnect Persistence
After the theft stage, the malware installs persistent remote access. On Linux and macOS it deploys a Go-based shell called “evjawbreaker.” On Windows it installs ScreenConnect clients, a legitimate remote support tool that gives the operator interactive control of the machine.
The combination means a victim loses more than wallet contents. Anyone who installed an affected version can also have an attacker-controlled shell or remote session running on the same machine, which survives removal of the original package.
SleepyDuck Links to Earlier Malicious VS Code Extensions
Socket and SafeDep tied the activity to SleepyDuck, a group previously associated with malicious Visual Studio Code extensions. The connection places the Ethersphere compromise within a series of attacks aimed at developer tooling and the crypto assets developers often keep on the same machines.
Cleanup Steps and Exposure for Affected Installers
Anyone who installed bee-js 13.3.0 or Swarm Desktop 0.56.2 faces risk of wallet theft and ongoing backdoor access. The recovery steps described in the reporting are extensive. Victims must remove hidden files left by the malware, disable services it installed and move funds to new wallets created from a clean machine. Moving funds from the same infected system would expose the new wallet keys to the same attacker.
The incident follows the usual shape of package-registry compromises: a trusted maintainer pipeline publishes a poisoned version, and the exposure window depends on how quickly maintainers and researchers notice. Here the timing is documented to the minute for npm, with 75 minutes of availability, while the desktop installer’s 8.5 hours gave a longer period for downloads.
The reporting does not say how the attackers gained the ability to publish under the Ethersphere name, or how many systems ran the malicious builds. Those details are the main unanswered questions. For now, the confirmed facts are the two affected version numbers, the command-and-control domain, the two remote access tools and the clean 0.56.3 release.
Timing Gap Between the npm Package and the Desktop Installer
The two malicious releases came within about half an hour of each other, with bee-js 13.3.0 published at 00:09 UTC and Swarm Desktop 0.56.2 at about 00:36 UTC. The npm package was replaced as the latest version after about 75 minutes, ending at 01:25 UTC, while the desktop build was removed roughly 8.5 hours after it appeared. Developers who pulled bee-js as a dependency during that early window, and users who downloaded the desktop application at any point during the longer one, are the two groups the researchers’ findings place at risk.
