# Hackers Compromise Ethersphere Tools to Distribute Wallet-Stealing Malware Attackers exploited release automation to inject backdoors into Swarm network software packages. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/185edbed-79ae-459b-9bc6-115c0abb3e5c ## Supply Chain Breach Overview Attackers compromised the Ethersphere project by hijacking its release automation systems. They published malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2 to official repositories. These updates were designed to steal private wallet keys and install persistent backdoors on Windows, macOS, and Linux systems, posing a significant risk to decentralized storage users. ## Automated Deployment Mechanism The malicious bee-js library was active on npm for 75 minutes, while the Swarm Desktop update remained available for 8.5 hours. The project's automated CI/CD pipeline, which lacked manual approval gates, facilitated the distribution. This allowed the malicious code to gain valid provenance, making it appear legitimate to users and security scanners. ## Data Theft and Exposure The malware specifically targets the Swarm Desktop data folder to extract config.yaml and swarm.key files. Because the application stores node passwords in plain text within the configuration file, attackers can decrypt the keystore. This grants them full access to xDAI and xBZZ tokens, as well as the node's chequebook funds and stake. ## Backdoor Installation Tactics On macOS and Linux, the malware installs a Go-based remote shell named evjawbreaker, which operates as a background service. On Windows, it deploys a legitimate ScreenConnect remote-access client signed by ConnectWise. The malware bypasses User Account Control prompts to gain administrator rights, effectively disabling security protections like Microsoft Defender to maintain persistent access. ## Attribution and Historical Context Security researchers link this incident to the group behind the EtherDuck and SleepyDuck campaigns. These attackers previously targeted Solidity developers via malicious extensions on the Open VSX marketplace. The current operation shares infrastructure, including specific Ethereum smart contracts and file naming conventions, suggesting a sophisticated, ongoing effort to compromise developer environments. ## Immediate Remediation Efforts Ethersphere maintainers have withdrawn the compromised versions and released Swarm Desktop 0.56.3. This update uses a newly issued Developer ID certificate to replace the malicious version. However, the project notes that these updates do not remove backdoors already installed on infected machines, requiring users to perform manual system cleanups to ensure security. ## Security Pipeline Failures The breach occurred because the project's signing jobs and npm publishing workflows required no human approval. Attackers utilized stolen CI credentials to trigger these builds manually. In response, the DevOps team has implemented mandatory approval gates for all signing jobs and restricted execution to the main branch to prevent future unauthorized releases. ## Critical User Recommendations Any computer that installed the malicious bee-js or Swarm Desktop versions must be considered fully compromised. Users should assume all stored credentials and private keys are exposed. Security experts recommend a complete system wipe and credential rotation, as simple software updates are insufficient to remove the sophisticated backdoors deployed by the attackers. ## Sources covering this story - https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._