Hackers Inject Malware to Steal Keys in Swarm Applications

Cybersecurity company SlowMist warned Ethereum ecosystem users about an attack on the Ethersphere software release infrastructure. Attackers injected malicious code into the JavaScript library @ethersphere/bee-js version 13.3.0 and the Swarm Desktop 0.56.2 application, designed for interaction with the decentralized data storage network Swarm. The programs could have been used to steal cryptocurrency wallet keys and install hidden remote access tools on Windows, macOS, and Linux computers.

The attack occurred on November 9, 2026, and was discovered by researchers from Socket and SafeDep. According to their data, the attackers used compromised Ethersphere publishing infrastructure credentials to distribute infected versions through official channels. As a result, the malware could have reached user devices during the regular installation of the library or update of Swarm Desktop.

How attackers injected malicious code

The malicious version of @ethersphere/bee-js 13.3.0 was distributed through the npm package registry. Researchers found that the attackers altered the library installation script to automatically download and execute additional JavaScript code. The infected package remained available for about 75 minutes before it was removed from npm.

About half an hour after the publication of bee-js, the attackers released Swarm Desktop 0.56.2, containing a similar malicious component. The application was distributed via GitHub, with the macOS version signed with a valid developer certificate and passing the standard Apple verification. According to Socket, the built-in update system could automatically offer the infected version to some Windows and macOS users.

SafeDep's research showed that the malicious code was designed to obtain Swarm node wallet files, including the encrypted key file and configuration containing the password for unlocking it. Additionally, the program could install additional components for remote computer management and maintain access after rebooting. This posed a risk not only to funds associated with the Swarm node but also to other credentials available on the infected device.

Ethereum smart contract used to manage the attack

A feature of the attack was the use of an Ethereum smart contract to store the address of the malicious program's command server. This mechanism allowed attackers to change the management infrastructure of infected computers without reinstalling the software. The smart contract was used as a tool for transmitting technical information, not for exploiting a vulnerability in the Ethereum blockchain itself.

Socket researchers found that this smart contract was previously used in the SleepyDuck and EtherDuck campaigns, associated with the distribution of malicious extensions for developers through the Open VSX catalog. Similarities were also found in individual components of the malware and the infrastructure used. These data indicate a probable connection between the attacks, but the identities of the attackers remain unknown.

Infected versions removed, users advised to check

After discovering the attack, Ethersphere developers removed the infected releases from official distribution channels. For the @ethersphere/bee-js library, version 13.2.0 remains safe, and a clean version 0.56.3 of Swarm Desktop was released on November 9. Linux users need to manually install the Swarm Desktop update, while supported Windows and macOS systems have automatic updates available.

However, replacing the application does not guarantee the elimination of infection consequences if the malicious code has already been executed on the computer. Researchers recommend considering such devices potentially compromised, checking them for remote access tools, and replacing passwords, tokens, and cryptographic keys from a trusted device. Funds associated with potentially exposed Swarm keys should be transferred to new addresses.

At the time of publication, confirmed amounts of stolen cryptocurrencies were not disclosed. The exact number of infected devices also remains unknown, as program download statistics include requests from researchers and automated security verification systems.