{"id":4138,"date":"2026-11-10T09:50:38","date_gmt":"2026-11-10T17:50:38","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4138"},"modified":"2026-11-10T09:50:38","modified_gmt":"2026-11-10T17:50:38","slug":"bee-js-swarm-desktop-supply-chain-compromise-signed-malware","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/bee-js-swarm-desktop-supply-chain-compromise-signed-malware\/","title":{"rendered":"Signed, Provenanced and Malicious: Hijacked Accounts Shipped Malware in bee-js 13.3.0 and Swarm Desktop 0.56.2"},"content":{"rendered":"\n

For about 75 minutes on 9 November, anyone who installed version 13.3.0 of the npm package @ethersphere\/bee-js<\/code> received malware, and Swarm Desktop 0.56.2 shipped the same loader in signed, notarized builds for Linux, macOS and Windows. Socket, which published the primary research, says the attacker used two hijacked GitHub accounts to run the project\u2019s own release workflows, so the npm provenance is valid and the desktop apps carry genuine signatures (Socket<\/a>).<\/p>\n\n\n\n

Malicious releases<\/strong><\/td>@ethersphere\/bee-js<\/code> 13.3.0 (npm); Swarm Desktop 0.56.2 (GitHub releases)<\/td><\/tr>
Safe versions<\/strong><\/td>bee-js 13.2.0<\/strong>; Swarm Desktop 0.56.3 recommended (not yet published at 10:30 UTC on 9 Nov, per Socket)<\/td><\/tr>
Exposure window<\/strong><\/td>npm: 00:09:50\u201301:24:58 UTC on 9 Nov 2026<\/td><\/tr>
Payload<\/strong><\/td>Steals Swarm config.yaml<\/code> and swarm.key<\/code>; Go backdoor (macOS\/Linux) or ScreenConnect as SYSTEM (Windows)<\/td><\/tr>
Attribution<\/strong><\/td>Socket assesses the same actor as the SleepyDuck\/EtherDuck Open VSX campaign<\/td><\/tr>
Evidence<\/strong><\/td>Confirmed (Socket primary research)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

Socket says compromised maintainer accounts pushed the malicious bee-js release to npm, where it was removed about 75 minutes later, and a trojanized Swarm Desktop release to GitHub, whose 0.56.2 tag was deleted at 09:04 UTC. Socket links the operation to the SleepyDuck\/EtherDuck campaign that targeted Open VSX extensions, based on matching on-chain activity, shared payload hashes, and identical persistence names and remote-access instance (Socket<\/a>; The Hacker News<\/a>). We don\u2019t know how the GitHub accounts were compromised, how many times 13.3.0 was downloaded, or whether Ethersphere has issued its own advisory.<\/p>\n\n\n\n

Timeline (UTC, 9 November 2026)<\/h2>\n\n\n\n
Time<\/th>Event<\/th><\/tr><\/thead>
00:09:50<\/td>Malicious bee-js 13.3.0 published to npm<\/td><\/tr>
01:24:58<\/td>13.3.0 removed from npm, about 75 minutes later<\/td><\/tr>
09:04<\/td>Swarm Desktop 0.56.2 release tag deleted<\/td><\/tr>
10:30<\/td>Swarm Desktop 0.56.3 still not published, per Socket<\/td><\/tr>
14:52<\/td>Socket publishes its research<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Source: Socket<\/a>. The command-and-control domain was registered on 6 November, three days before the releases.<\/em><\/p>\n\n\n\n

Who is affected<\/h2>\n\n\n\n

The direct victims are developers, CI pipelines and Swarm Desktop users who installed the two malicious versions, along with any credentials those machines could reach. MAG212 CYBER analysis:<\/strong> the wider lesson applies to every organisation that publishes software, because the attack worked through release automation that many projects share.<\/p>\n\n\n\n

How the attack works<\/h2>\n\n\n\n

Socket\u2019s account (Socket<\/a>):<\/p>\n\n\n\n