--- title: Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop... description: Attackers compromised two Ethersphere GitHub accounts and used the project's CI to publish a malicious `@ethersphere/bee-js` 13.3.0 on npm and a trojanized... canonical: https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 Delivered the SleepyDuck Backdoor | daily.dev og:description: Attackers compromised two Ethersphere GitHub accounts and used the project's CI to publish a malicious `@ethersphere/bee-js` 13.3.0 on npm and a trojanized... og:url: https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax og:image: https://api.daily.dev/og/posts/9nzhfwCAx.png og:image:alt: Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 Delivered the SleepyDuck Backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 Delivered the SleepyDuck Backdoor **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Attackers compromised two Ethersphere GitHub accounts and used the project's CI to publish a malicious `@ethersphere/bee-js` 13.3.0 on npm and a trojanized Swarm Desktop 0.56.2 release. Both carry an install hook that downloads and runs JavaScript from `api.frameworkmetrics.xyz` with full privileges. Payloads go after Swarm Desktop wallet material, including Bee node wallet keys and passwords, then try to set up persistent access with a Go backdoor or, on Windows, a hidden ScreenConnect client. npm pulled the package after about 75 minutes, but the Swarm Desktop build, signed and notarized by Apple, stayed live roughly eight and a half hours. Later stages read their command-and-control address from an Ethereum smart contract shared with the earlier SleepyDuck/EtherDuck campaign on Open VSX. ## Content Version 13.3.0 of `@ethersphere/bee-js` on npm was malicious, and so was a Swarm Desktop 0.56.2 release. Attackers compromised two Ethersphere GitHub accounts and used the project's own CI to publish both. ## What the releases do The npm package ships an install hook that downloads remote JavaScript from api.frameworkmetrics.xyz and runs it with full privileges. The trojanized Swarm Desktop build carries the same loader. Later stages read their command-and-control address from an Ethereum smart contract. That contract is shared with the earlier SleepyDuck/EtherDuck campaign on Open VSX, which Pluto Security documented. The payloads go after Swarm Desktop wallet material, including Bee node wallet keys and passwords. They then install a persistent backdoor: a Go implant, or on Windows a hidden ScreenConnect remote-access client. ## Timeline and reach - npm pulled 13.3.0 after about 75 minutes. - The Swarm Desktop release stayed live for roughly eight and a half hours. It was signed and notarized by Apple, and the auto-updater offered it to Windows x64 and Apple Silicon users. - The package had 3,560 downloads across all versions from November 1 to 7, 2026. That number doesn't say how many of them were the compromised 13.3.0. ## How it got through The npm release had valid provenance, and the attackers never needed an npm token. They used Ethersphere's own release bot. @feross put the lesson plainly: with trusted publishing, the workflow is the credential, so it should refuse to publish any commit that isn't on a protected branch. StepSecurity is still investigating and plans to publish a detailed technical report. ## If you installed either release Treat the machine as compromised. Rotate any Bee node wallet keys and passwords that were present, and check for unexpected ScreenConnect clients on Windows. ## Questions this post answers ### What does the compromised @ethersphere/bee-js 13.3.0 npm package do? It ships a malicious install hook that downloads JavaScript from api.frameworkmetrics.xyz and runs it with full privileges. The payload steals Swarm Desktop wallet material, including Bee node wallet keys and passwords, then installs a Go backdoor or, on Windows, a hidden ScreenConnect remote-access client. The command-and-control address comes from an Ethereum smart contract. _Teams auditing dependencies for supply chain risks can track incidents like this one on daily.dev._ ### How long was the malicious Swarm Desktop 0.56.2 release available before being pulled? The trojanized Swarm Desktop 0.56.2 release stayed live for roughly eight and a half hours, offered to Windows x64 and Apple Silicon users through the auto-updater. It was signed and notarized by Apple despite being malicious. The npm package @ethersphere/bee-js 13.3.0 was pulled much faster, after about 75 minutes. _Developers tracking fast-moving supply chain incidents can follow the timeline details on daily.dev._ ### What should I do if I installed @ethersphere/bee-js 13.3.0 or Swarm Desktop 0.56.2? Treat the machine as compromised: rotate any Bee node wallet keys and passwords and move funds if exposed, look for a Go backdoor and, on Windows, an unexpected ScreenConnect client, check for connections to api.frameworkmetrics.xyz, and pin to a bee-js version released before 13.3.0. _Anyone responding to an active compromise can find remediation steps like these on daily.dev._ ## Similar posts on daily.dev - [Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys](https://daily.dev/posts/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys-qvukjacsf) · StepSecurity · 0 upvotes · 0 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments - [Injective SDK on npm infected with cryptocurrency wallet stealer](https://daily.dev/posts/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-2u95ebyn1) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 Delivered the SleepyDuck Backdoor","url":"https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax"},"datePublished":"2026-11-09T16:37:10.497Z","dateModified":"2026-11-09T19:49:10.607Z","description":"Attackers compromised two Ethersphere GitHub accounts and used the project's CI to publish a malicious `@ethersphere/bee-js` 13.3.0 on npm and a trojanized...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fc25ae6c4f157ae87bce3c596daf01a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fc25ae6c4f157ae87bce3c596daf01a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Compromised @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 Delivered the SleepyDuck Backdoor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/compromised-ethersphere-bee-js-13-3-0-and-swarm-desktop-0-56-2-delivered-the-sleepyduck-backdoor-9nzhfwcax#faq","mainEntity":[{"@type":"Question","name":"What does the compromised @ethersphere/bee-js 13.3.0 npm package do?","acceptedAnswer":{"@type":"Answer","text":"It ships a malicious install hook that downloads JavaScript from api.frameworkmetrics.xyz and runs it with full privileges. The payload steals Swarm Desktop wallet material, including Bee node wallet keys and passwords, then installs a Go backdoor or, on Windows, a hidden ScreenConnect remote-access client. The command-and-control address comes from an Ethereum smart contract. Teams auditing dependencies for supply chain risks can track incidents like this one on daily.dev."}},{"@type":"Question","name":"How long was the malicious Swarm Desktop 0.56.2 release available before being pulled?","acceptedAnswer":{"@type":"Answer","text":"The trojanized Swarm Desktop 0.56.2 release stayed live for roughly eight and a half hours, offered to Windows x64 and Apple Silicon users through the auto-updater. It was signed and notarized by Apple despite being malicious. The npm package @ethersphere/bee-js 13.3.0 was pulled much faster, after about 75 minutes. Developers tracking fast-moving supply chain incidents can follow the timeline details on daily.dev."}},{"@type":"Question","name":"What should I do if I installed @ethersphere/bee-js 13.3.0 or Swarm Desktop 0.56.2?","acceptedAnswer":{"@type":"Answer","text":"Treat the machine as compromised: rotate any Bee node wallet keys and passwords and move funds if exposed, look for a Go backdoor and, on Windows, an unexpected ScreenConnect client, check for connections to api.frameworkmetrics.xyz, and pin to a bee-js version released before 13.3.0. Anyone responding to an active compromise can find remediation steps like these on daily.dev."}}]} ```