Hackers Hijacked Ethersphere's Release Pipeline to Steal Bee Node Keys

Hackers seized Ethersphere's software release system on November 9 and pushed malware through two official distribution channels: the bee-js 13.3.0 package on npm and the Swarm Desktop 0.56.2 release. The malicious code searched for Bee node wallet private keys on infected machines, according to analyses by cybersecurity firms Socket and StepSecurity.

The two tainted releases had very different exposure windows. The bee-js package remained available on npm for roughly 75 minutes. The Swarm Desktop release stayed online for almost eight and a half hours.

Why the malware looked legitimate

The breach is notable because standard integrity checks passed. Socket confirmed that bee-js carried valid SLSA provenance. The Swarm Desktop macOS installer was signed and Apple-notarized, and it could reach users of Apple Silicon and Windows machines through the auto-update mechanism.

The verification chain established where the software came from, not whether it was safe. Attackers inserted malicious code into trusted build workflows. Socket linked the compromise to hijacked GitHub accounts, including the release bot bee-worker. How the attackers obtained that access remains unknown.

The plain takeaway: provenance and code signing did not stop a supply-chain attack.

What the malware actually did

StepSecurity found that the attackers modified scripts/generate-version.cjs to download malicious code from api.frameworkmetrics[.]xyz. The script executed automatically when developers installed bee-js 13.3.0 — even if they never actually used the library.

The malware hunted for two files: config.yaml and the files holding Bee node wallet keys. It also installed backdoors for persistent remote access. On Windows, the backdoor used ScreenConnect. On Linux and macOS, it disguised itself as legitimate Solidity development tools.

A familiar wallet, a new method

Socket identified the Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 as the mechanism the malware used to locate its command-and-control servers. Pluto Security had previously connected the same contract to the SleepyDuck and EtherDuck campaigns, which spread malware through fake Solidity browser extensions.

This time the operators changed tactics. Instead of persuading developers to download counterfeit tools, they attacked Ethersphere's authentic release pipeline directly. The approach mirrors an earlier npm supply-chain incident, reported by Cryptopolitan, in which attackers distributed malware through packages tied to Arweave's WeaveDB project.

What operators must do now

Ethersphere published two official notices identifying both releases as malicious. A maintainer, darkobas2, stated in a recovery pull request that version 0.56.2 "was built and published by an attacker using stolen CI credentials." The clean replacement, 0.56.3, contains "same code as 0.56.1" and is signed with a new certificate.

Recommended actions, per the notices:

• Swarm Desktop users should verify their version and install 0.56.3; Linux users must update manually.
• bee-js users should pin version 13.2.0.
• Anyone who ran the malware should isolate and rebuild the machine, move funds and stake from a clean device, and rotate all credentials.

An update alone will not remove an installed backdoor. Operators who patched but did not rebuild should assume the machine remains compromised.

How big is the blast radius?

The numbers available are download counts, not victim counts. Socket recorded 65 downloads of the tainted Desktop release by 08:27 UTC on November 9 — a figure that includes security researchers — and estimated roughly ten fetches of bee-js 13.3.0. No confirmed tally of infected machines or stolen funds exists. Ethersphere has not disclosed how the CI credentials were stolen.

Context from CertiK's dashboard underscores the sector-wide pattern rather than this incident: wallet compromise ranks second among 2026 losses at $769.1 million across 75 incidents, and private-key compromise ranks fifth at $158 million across 47 incidents. Those figures are industry aggregates, not Ethersphere-specific losses.

CoinGecko showed BZZ trading near $0.0654 on November 10, and no breach-driven selloff has been established. The material exposure here is operational, not market price: node operators who auto-updated may be running backdoored machines with exposed staking keys, and the attacker's access method — stolen CI credentials — remains unexplained.

Until Ethersphere clarifies how the release bot and GitHub accounts were compromised, every downstream project depending on its release pipeline should treat automated updates as unverified.