ARTICLE ORIGINAL MAG212 CYBER

Signed, Provenanced and Malicious: Hijacked Accounts Shipped Malware in bee-js 13.3.0 and Swarm Desktop 0.56.2

10 novembre 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: a software package with a valid signature seal and a hidden red payload inside, headline 'Signed, provenanced and malicious'.

For about 75 minutes on 9 November, anyone who installed version 13.3.0 of the npm package @ethersphere/bee-js received malware, and Swarm Desktop 0.56.2 shipped the same loader in signed, notarized builds for Linux, macOS and Windows. Socket, which published the primary research, says the attacker used two hijacked GitHub accounts to run the project’s own release workflows, so the npm provenance is valid and the desktop apps carry genuine signatures (Socket).

Malicious releases@ethersphere/bee-js 13.3.0 (npm); Swarm Desktop 0.56.2 (GitHub releases)
Safe versionsbee-js 13.2.0; Swarm Desktop 0.56.3 recommended (not yet published at 10:30 UTC on 9 Nov, per Socket)
Exposure windownpm: 00:09:50–01:24:58 UTC on 9 Nov 2026
Charge utileSteals Swarm config.yaml et swarm.key; Go backdoor (macOS/Linux) or ScreenConnect as SYSTEM (Windows)
AttributionSocket assesses the same actor as the SleepyDuck/EtherDuck Open VSX campaign
EvidenceConfirmed (Socket primary research)

Ce qui s'est passé

Socket says compromised maintainer accounts pushed the malicious bee-js release to npm, where it was removed about 75 minutes later, and a trojanized Swarm Desktop release to GitHub, whose 0.56.2 tag was deleted at 09:04 UTC. Socket links the operation to the SleepyDuck/EtherDuck campaign that targeted Open VSX extensions, based on matching on-chain activity, shared payload hashes, and identical persistence names and remote-access instance (Socket; Les actualités des hackers). We don’t know how the GitHub accounts were compromised, how many times 13.3.0 was downloaded, or whether Ethersphere has issued its own advisory.

Timeline (UTC, 9 November 2026)

TimeÉvénement
00:09:50Malicious bee-js 13.3.0 published to npm
01:24:5813.3.0 removed from npm, about 75 minutes later
09:04Swarm Desktop 0.56.2 release tag deleted
10:30Swarm Desktop 0.56.3 still not published, per Socket
14:52Socket publishes its research

Source: Socket. The command-and-control domain was registered on 6 November, three days before the releases.

Qui est concerné ?

The direct victims are developers, CI pipelines and Swarm Desktop users who installed the two malicious versions, along with any credentials those machines could reach. Analyse CYBER MAG212 : the wider lesson applies to every organisation that publishes software, because the attack worked through release automation that many projects share.

Comment fonctionne l'attaque

Socket’s account (Socket):

  • The accounts: nugaon, a maintainer with force-push rights to an unprotected master branch, and bee-worker, the release-automation account.
  • bee-js: an unsigned commit turned a version-generation script into a loader and changed the prepare hook to postinstall. A GitHub release then triggered the project’s legitimate npm publishing workflow, whose publish environment had no required reviewers and no tag policy.
  • Swarm Desktop: an unsigned branch named emergency/0.56.2 added the loader, and a manually dispatched pre-release workflow that accepts any branch and holds Apple and Windows signing certificates built, signed and notarized the trojanized app.
  • Payload: the loader fetches code from api.frameworkmetrics[.]xyz, steals the Swarm node’s configuration (which holds a plaintext password) and key, then installs a Go backdoor under ~/.solidity/ on macOS and Linux that reads its server address from an Ethereum contract. On Windows it attempts a UAC bypass, adds a Defender exclusion and silently installs ConnectWise ScreenConnect as a SYSTEM service.
Attack chain: hijacked GitHub accounts, unsigned changes, legitimate release workflows and trusted-looking releases, followed by loader, theft and persistence stages; a bar marks the 75-minute npm window on 9 November.
From hijacked accounts to signed malware. Based on Socket’s research. Diagram: MAG212 CYBER

Que rechercher

Key indicators published by Socket; the full list, including commit hashes and the npm integrity string, is in its post (Socket):

TaperIndicateur
Emballer@ethersphere/bee-js@13.3.0
Domaineapi.frameworkmetrics[.]xyz
Hub IPs (port 4912)193.57.9[.]155, 193.57.9[.]17, 178.16.54[.]222, 107.189.27[.]223, 107.189.27[.]46, 91.108.240[.]156, 107.189.16[.]215
ScreenConnect relay185.232.84[.]169:8041
Ethereum contract0xf8a900Db50b3331be6B768bA460BB59f3E40C344
Persistance~/.solidity/; solidity-langsupport-runner.service; LaunchAgent com.solidity.langsupport.runner; service ScreenConnect Client (5cbe79c9c25524df)
Desktop logBee Desktop version: 0.56.2 (production) dans bee-desktop.log

Investigate, contain and fix

  1. Search lockfiles, caches and internal registries for bee-js 13.3.0; pin 13.2.0 and purge mirrors.
  2. Treat any machine or CI job that installed 13.3.0 with install scripts enabled during the exposure window as compromised, even if the install failed.
  3. Rotate every credential those machines or jobs could reach, including cloud credentials trusted through CI OIDC.
  4. Swarm Desktop users: assume the node password and key are stolen and move funds to a new key from a clean machine.
  5. Manually remove ~/.solidity/, the LaunchAgent, the systemd unit and the ScreenConnect service; reinstalling the app does not remove them.
  6. Hunt in DNS and proxy logs for the domain and IP addresses above.

All steps from Socket. No vendor commands were published, so none are given.

How to confirm you’re clean

  • Lockfiles and builds resolve bee-js to 13.2.0.
  • The persistence files, services and ScreenConnect client are gone, and stay gone after a reboot.
  • No further connections appear to the hub or relay addresses.

Lessons for maintainers, admins and leaders

  • Maintainers: require reviewers on publish environments, restrict which tags can deploy, protect release branches, and never expose signing credentials to manually dispatched workflows. Scope release-bot tokens narrowly and rotate them (Socket’s recommendations).
  • Security teams: valid provenance and notarization prove which pipeline built the code, not that the code is safe.
  • Dirigeants : GitHub plans to block pull_request_target workflows by default from 2 December (Socket); use it as a prompt to review who can trigger your own release pipelines.

Ce que nous ignorons encore

  • How the two GitHub accounts were compromised.
  • How many installs of 13.3.0 occurred during the window.
  • Whether Swarm Desktop 0.56.3 has shipped and whether Ethersphere has published its own advisory.

Sujets connexes sur MAG212 CYBER

Sources