Ethersphere npm Package and Swarm Desktop Releases Hijacked to Steal Wallets

Attackers compromised the npm package @ethersphere/bee-js version 13.3.0 and Ethersphere’s Swarm Desktop GitHub releases, distributing malware that targets wallet data and establishes remote access. StepSecurity found that the npm release downloaded and executed attacker-controlled JavaScript during installation, with platform-specific payloads targeting Linux, macOS, and Windows. OX Security reported theft of local Swarm configurations and encrypted wallet keys, deployment of ScreenConnect on Windows, and the evjawbreaker remote access trojan on Linux and macOS. The malicious source apparently entered the legitimate publishing workflow through misuse of the bee-worker release identity, allowing the package to retain valid SLSA provenance; OX Security identified a stolen developer access key as a possible enabling factor.

The compromised npm version was revoked, but OX Security reported that the malicious GitHub release and attack infrastructure remained accessible at publication. Downstream dependency ranges could select the malicious npm release, and the affected package ecosystem receives more than 16,800 monthly downloads; neither figure establishes actual infections, wallet exposures, or stolen funds. Defenders should inspect dependencies and lockfiles, revert to verified clean releases, and investigate systems where installation-time payloads may have executed. Package removal alone is insufficient for executed payloads: response should include persistence checks, assessment of exposed wallets, credential rotation, and rebuilding affected systems from trusted images. Minimum package-age policies can help reduce exposure to newly published malicious releases.