The bee-js security vulnerability lasted 75 minutes and left backdoors that could not be fixed by an update
The attackers distributed a malicious version of Ethersphere's npm @ethersphere/bee-js package and a Swarm Desktop release containing a backdoor, providing code to steal wallets and persistent remote access on Windows, macOS, and Linux.
11/10/20264 min read
The event lasted for an extremely short time.
The malicious bee-js 13.3.0 version only existed on npm for about 75 minutes, released at 00:09:50 UTC and removed at 01:24:58. Swarm Desktop 0.56.2 remained available for about 8.5 hours and was automatically updated for Windows x64 and Apple Silicon Mac users, completely eliminating any possibility of user error. Socket estimates there were about 10 npm package downloads compared to 3,741 bee-js downloads the previous week, and 65 desktop version downloads as of 08:27 UTC, including researchers.
These numbers are very small, and small numbers are not a cause for concern here. The target is the operators of Swarm nodes, each node holding a wallet key, and the second-stage payload reads the node's config.yaml and swarm.key files and sends both to the attacker. That combination is the wallet key and its plain text password. Just one successful infection of a heavily invested operating server is enough to cover the operating costs.
Why is proof of origin not helpful?
The malicious code was released through a legitimate CI process and Ethersphere's trusted publishing process, meaning the origin certificates on the software package are correct. Any supply chain defense measures verifying the software package comes from the correct repository through the correct process will yield satisfactory results.
This is a frustrating lesson. The origin proof demonstrates that the build process created the product. It proves nothing about whether the source commit was authorized, and the attackers gained access to the nugaon and bee-worker GitHub accounts, with the origin of that access still unexplained. A rewritten versioning script became a hook that installed, loaded, and executed remote JavaScript with full Node privileges, and it was delivered to users through a trusted process. The same loader ran in Electron's main process on every Swarm Desktop launch, so users who installed the update and never opened the terminal were completely exposed.
The ability to survive persistently is the least reported aspect.
On macOS and Linux, the malware installs a Go backdoor into the ~/.solidity/ directory, existing as a systemd user unit named solidity-langsupport-runner.service or a LaunchAgent named com.solidity.langsupport.runner, providing remote shell access. On Windows, a PowerShell loader attempts to escalate privileges, adds a Microsoft Defender exception, and silently installs a ScreenConnect client as a SYSTEM service.
A ScreenConnect client running with SYSTEM privileges allows full remote control of the computer using legitimate commercial remote assist software, which most endpoint tools will not detect. The Defender exception means the attacker has explicitly disabled detection. None of this is removed by uninstalling Swarm Desktop or pinning bee-js back to version 13.2.0.
Troubleshooting requires manually deleting the ~/.solidity/ directory, LaunchAgent, systemd unit, and ScreenConnect service, rotating any accessible credentials from the environment, including CI cloud credentials, and transferring funds to a newly generated key on a clean machine. Anyone who ran the installer with scripts enabled during that time should assume the environment was compromised rather than hoping the estimated download count would protect them.
The control channel is located on the blockchain.
The operator stores the current hub address and payload URL in an Ethereum contract at 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, deployed in March 2026, allowing them to rotate the C2 server without touching the malware. A similar contract and wallet appeared in the previous SleepyDuck campaign against Open VSX.
Using smart contracts as configuration repositories offers better resilience than conventional C2. There are no domains to hijack and no servers to take down, and lookup traffic is a regular RPC call. Defenders simply need to monitor connections to api.frameworkmetrics.xyz , a domain registered on November 6th, three days before use.
Assessment and Conclusion
This follows the GitBook login leak on November 2nd and the earlier Keystone third-party monitoring tool breach. The common thread in all three incidents is that none involved cryptography or protocols. They stole developer and vendor login credentials and then used trusted distribution channels to reach users.
For protocol development teams, the practical conclusion most haven't yet reached is to list all login credentials that can access the repository or publishing process and treat that list as the actual attack surface. For node operators, the auto-update feature is a utility that allows a compromised maintainer account to execute directly on your machine, and for any software that holds keys, this feature needs to be disabled.
Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.
Compiled and analyzed by HCCVenture
Join our information channels: https://link3.to/holdcoincventure
Explore HCCVenture group
HCCVENTURE QUANT JSCO
© 2026 HCCVENTURE. ALL COPYRIGHTS RESERVED.
Connect with us
Popular content
Contact to us
Address: 8th Floor, Bach Dang Complex Building, 50 Bach Dang Street, Hai Chau Ward, Da Nang City, Vietnam.
Phone: 1900 1509
Gmail : sp_contact@hccventure.com
Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.
TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY
ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.
RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY
Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.
