Swarm Release Pipeline Hijacked to Target Node Keys

On 9 November 2026, an attacker used the Swarm project's own release automation to ship two malicious builds: @ethersphere/bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 on GitHub. Both carried a small loader that fetches code from an attacker-controlled server. According to the GitHub advisory and the analyses by Socket and StepSecurity, the follow-on code targets the Swarm node's wallet key and the password stored next to it, and installs a persistent backdoor. Ethersphere has withdrawn both releases and published a clean Swarm Desktop 0.56.3.

What happened#

bee-js is the JavaScript client for Bee, the node software of the Swarm decentralized storage network. Swarm Desktop is the app that runs a Bee node, including its Ethereum wallet, on a user's own computer.

npm records 13.3.0 as published at 00:09:50 UTC on 9 November. GitHub issued advisory GHSA-hh7j-5m3j-23pf at 01:25:27 UTC, and Socket reports the package was removed from npm at about the same time, roughly 75 minutes after it went live. The advisory states that any computer that installed or ran the package "should be considered fully compromised". npm now lists 13.2.0 as latest again.

The bee-js loader ran as a postinstall script, so a project did not need to import the library for it to execute.

Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC and, per Socket, stayed public for about eight and a half hours. Because it was published as a full release, the built-in auto-updater could offer it to Windows x64 and Apple Silicon Mac users. Intel Macs were not offered it, and Linux packages do not auto-update. Ethersphere published 0.56.3 at 12:52 UTC with the note "replace compromised 0.56.2 release". The Hacker News quotes a maintainer saying 0.56.2 "was published by an attacker using stolen CI credentials".

How the pipeline was abused#

Socket and StepSecurity both describe an unsigned commit pushed under the project's release identity, bee-worker, outside the normal release pull request flow. A GitHub release on that commit triggered the legitimate npm workflow, which published it through trusted publishing with no approval step. The result carried valid SLSA provenance. Socket verified the attestation and points out that provenance proves where a package was built, not that anyone reviewed its source.

For the desktop app, Socket reports that a manually triggered workflow with access to the signing certificates built, signed and Apple-notarized the trojanized macOS app. macOS therefore showed only its normal first-launch prompt.

The follow-on code looks for Swarm Desktop's config.yaml and keys/swarm.key. The key file is an encrypted keystore, but the configuration holds its password in plain text, so the two files together are enough to control the node wallet. Socket also links the backdoor's command-and-control lookup, which reads an address from an Ethereum smart contract, to an earlier campaign that used fake Solidity extensions on Open VSX.

What is known and unknown#

Known: the affected versions, the timeline, the targeted files and the clean versions (bee-js 13.2.0, Swarm Desktop 0.56.3).

Unknown: how the release credentials were first obtained, how many machines ran the loader, and whether any funds have been taken. The Hacker News reported no theft of funds at the time of writing. Download figures are rough. Socket estimates on the order of ten fetches of bee-js 13.3.0, and counted 65 downloads of Swarm Desktop 0.56.2 assets by 08:27 UTC. Both figures include researchers and scanners.

Our view#

As XDRIP Digital Management LLC, we read this as a custody lesson as much as a supply-chain story. A key that sits on disk next to its own password is only as safe as every update that machine accepts. Signatures, notarization and provenance all passed here, because the attacker used the project's own pipeline. Every one of those checks proves where something was built, not who approved it.

For affected users, the published guidance is clear: check bee-desktop.log for version 0.56.2. If it ever ran, treat the node key and password as stolen and move funds, chequebook and stake to a new key from a clean machine. Removing the app does not remove the backdoor. We will follow Ethersphere's updates on the root cause.

Sources#

• GitHub Advisory GHSA-hh7j-5m3j-23pf, Malware in @ethersphere/bee-js (9 Nov 2026): https://github.com/advisories/GHSA-hh7j-5m3j-23pf
• Ethersphere, Swarm Desktop v0.56.3 release (9 Nov 2026): https://github.com/ethersphere/swarm-desktop/releases/tag/v0.56.3
• npm registry, @ethersphere/bee-js versions: https://www.npmjs.com/package/@ethersphere/bee-js?activeTab=versions
• Socket Research Team (9 Nov 2026): https://socket.dev/blog/bee-js-compromise
• StepSecurity (9 Nov 2026): https://www.stepsecurity.io/blog/ethersphere-bee-js-13-3-0-compromise
• The Hacker News (9 Nov 2026): https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html