Malicious Builds of Ethersphere's bee-js and Swarm Desktop Targeted Wallet Keys
Anyone who installed or ran the affected builds should assume their node key, password and funds are exposed and rotate them.
Attackers published booby-trapped builds of two Ethersphere tools for the Swarm storage network by abusing the project's own release pipeline: the bee-js library at version 13.3.0 and the Swarm Desktop app at 0.56.2. Both carried a loader that fetches and runs hidden code designed to exfiltrate the node's wallet key file and the plaintext password that unlocks it, and to plant a remote-access backdoor on Windows, macOS and Linux. The bee-js build was live on npm for roughly 75 minutes and ran automatically during installation, while the Swarm Desktop build was withdrawn after about eight and a half hours, though its updater could have offered it to Windows and Apple Silicon users in the meantime. Maintainers pulled both releases and shipped a clean Swarm Desktop 0.56.3, but that does not undo an infection that already happened. Anyone who ran either build should treat the machine as compromised and rotate the node's key, password and funds, and remove the leftover backdoor artifacts.
Why it matters
The attack used the project's own release automation, so the software's normal trust signals did not protect users. Developers and node operators who pulled bee-js 13.3.0 or ran Swarm Desktop 0.56.2 may have had their wallet key file and plaintext password sent to attackers, and a backdoor may remain on their machines even after the clean release. Because Swarm Desktop stores its password in plain text, the exposure extends beyond the code itself to every node that ran the build. For the wider Swarm community, the episode shows that a compromised release channel can reach users before maintainers react, and that a clean replacement does not undo an infection that has already happened.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.