Hackers Compromise Ethersphere Tools to Distribute Wallet-Stealing Malware
Attackers exploited release automation to inject backdoors into Swarm network software packages.
1Supply Chain Breach Overview
Attackers compromised the Ethersphere project by hijacking its release automation systems. They published malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2 to official repositories. These updates were designed to steal private wallet keys and install persistent backdoors on Windows, macOS, and Linux systems, posing a significant risk to decentralized storage users.
2Automated Deployment Mechanism
The malicious bee-js library was active on npm for 75 minutes, while the Swarm Desktop update remained available for 8.5 hours. The project's automated CI/CD pipeline, which lacked manual approval gates, facilitated the distribution. This allowed the malicious code to gain valid provenance, making it appear legitimate to users and security scanners.
3Data Theft and Exposure
The malware specifically targets the Swarm Desktop data folder to extract config.yaml and swarm.key files. Because the application stores node passwords in plain text within the configuration file, attackers can decrypt the keystore. This grants them full access to xDAI and xBZZ tokens, as well as the node's chequebook funds and stake.
4Backdoor Installation Tactics
On macOS and Linux, the malware installs a Go-based remote shell named evjawbreaker, which operates as a background service. On Windows, it deploys a legitimate ScreenConnect remote-access client signed by ConnectWise. The malware bypasses User Account Control prompts to gain administrator rights, effectively disabling security protections like Microsoft Defender to maintain persistent access.
5Attribution and Historical Context
Security researchers link this incident to the group behind the EtherDuck and SleepyDuck campaigns. These attackers previously targeted Solidity developers via malicious extensions on the Open VSX marketplace. The current operation shares infrastructure, including specific Ethereum smart contracts and file naming conventions, suggesting a sophisticated, ongoing effort to compromise developer environments.
6Immediate Remediation Efforts
Ethersphere maintainers have withdrawn the compromised versions and released Swarm Desktop 0.56.3. This update uses a newly issued Developer ID certificate to replace the malicious version. However, the project notes that these updates do not remove backdoors already installed on infected machines, requiring users to perform manual system cleanups to ensure security.
7Security Pipeline Failures
The breach occurred because the project's signing jobs and npm publishing workflows required no human approval. Attackers utilized stolen CI credentials to trigger these builds manually. In response, the DevOps team has implemented mandatory approval gates for all signing jobs and restricted execution to the main branch to prevent future unauthorized releases.
8Critical User Recommendations
Any computer that installed the malicious bee-js or Swarm Desktop versions must be considered fully compromised. Users should assume all stored credentials and private keys are exposed. Security experts recommend a complete system wipe and credential rotation, as simple software updates are insufficient to remove the sophisticated backdoors deployed by the attackers.