Attackers use Swarm's own release pipeline to ship wallet-stealing versions of bee-js and Swarm Desktop
November 9, 2026 (November 9, 2026)
On November 9 attackers used the Ethersphere project's own release automation to publish malicious versions of two tools for the Swarm decentralized storage network. The npm library bee-js 13.3.0 was live for about 75 minutes, and the Swarm Desktop app 0.56.2 was on GitHub for about eight and a half hours, where its updater could push it to Windows and Apple Silicon Macs. Because the project's real build workflows produced them, the npm package carried valid provenance and the Mac app was signed and notarized. Two GitHub accounts were involved, an automation account and a long-time maintainer's account. The malware sends the node's key file and configuration to the attackers, and Swarm Desktop keeps the key password in that configuration, so node wallets can be unlocked. It also installs a backdoor. Researchers at Socket and Pluto Security tie it to the group behind the 2025 SleepyDuck extension. No theft had been reported, and estimates put downloads at about 10 for bee-js and 65 for the desktop app. Clean Swarm Desktop 0.56.3 is out.
Why it matters
Signatures and provenance prove where a release was built, not that the source was clean. Once attackers control a project's build pipeline, its releases look legitimate.
What defenders can take from it
- Swarm Desktop users: check bee-desktop.log for version 0.56.2, install 0.56.3 and, if 0.56.2 ran, move funds to a new key created on a clean machine.
- Developers: search lockfiles and build logs for bee-js 13.3.0, pin 13.2.0 and treat machines that installed 13.3.0 as compromised.
- Projects: require approval for release workflows and protect signing keys so one stolen account cannot publish.