Malicious Ethersphere Releases Deliver Wallet-Stealing Malware and Backdoors
Summary
Attackers used Ethersphere's release workflows to publish malicious bee-js 13.3.0 and Swarm Desktop 0.56.2, designed to steal Swarm wallet files and install cross-platform backdoors. The releases were withdrawn; no fund theft had been reported.
Key points
- Malicious bee-js 13.3.0 was available on npm for about 75 minutes; its postinstall script ran automatically, even if a project did not import the library.
- Swarm Desktop 0.56.2 was available for about 8.5 hours. Its updater could offer it to Windows x64 computers and Apple Silicon Macs; Linux installs did not update automatically.
- SafeDep found that both releases downloaded code from api[.]frameworkmetrics[.]xyz. The code sought Swarm Desktop's config and encrypted key files and sent them to the attackers' server.
- The payload installed the evjawbreaker remote shell on Linux and macOS, and a ScreenConnect client on Windows. On Windows, it could add a Microsoft Defender exclusion when run with administrator rights.
- Ethersphere withdrew the releases and issued clean Swarm Desktop 0.56.3. The update does not remove an installed backdoor or protect a key already sent; Linux packages require manual replacement.
- The maintainer attributed the release to an attacker using stolen CI credentials, but how the credentials were obtained remains unclear. The project has since added approval requirements to app-signing jobs.
- No theft of funds had been reported. The article gives no count of infected machines; reported download counts included researchers, scanners, and mirrors.
Article Details
- Victim Organization
- Ethersphere
- Incident Type
- Compromise of release automation to publish malicious versions of bee-js and Swarm Desktop
- Data Types Exposed
- Swarm node wallet key (encrypted Ethereum keystore)
- Plain-text password stored in config.yaml
- Affected Records
- Not disclosed; no count of infected machines was provided.
- Affected Data Size
- Not disclosed.
- Operational Impact
- Malicious releases of bee-js 13.3.0 and Swarm Desktop 0.56.2 could download and run code that installs a backdoor on Windows, macOS, and Linux. The code was designed to send the Swarm wallet key and its stored password to the attackers' server when the relevant files were present. No theft of funds had been reported at the time of writing. The releases were withdrawn and a clean Swarm Desktop version 0.56.3 was released; existing backdoors and previously sent keys were not removed or protected by those actions.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]frameworkmetrics[.]xyz | Malicious code download domain used by the loader in both compromised releases. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe downloaded code was designed to send the Swarm key and password to the attackers' server.T1059.007 · JavaScriptThe bee-js package ran malicious code through an npm postinstall script.T1105 · Ingress Tool TransferThe loader downloaded additional code from api.frameworkmetrics[.]xyz.T1195.002 · Compromise Software Supply ChainAttackers used compromised release automation to publish malicious software packages and an application release.T1543.001 · Launch AgentOn macOS, the backdoor ran as a LaunchAgent.T1543.003 · Windows ServiceOn Windows, the remote-access client ran as a system service.T1548.002 · Bypass User Account ControlThe code used a described method to bypass the User Account Control prompt when the user was an administrator.T1562.001 · Disable or Modify ToolsWith administrator rights, the code added a Microsoft Defender exclusion.
Malware
Products
@ethersphere/bee-jsAttackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.bee-dashboardThe project's own swarm-cli and bee-dashboard packages, and the Swarm Desktop source code, accepted version ranges that included 13.3.0. A fresh install within that window could have pulled in the malicious version.GitHubSwarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC today and was withdrawn about 8.5 hours later. The app's built-in updater could offer it to Windows x64 computers and Apple Silicon Macs within about 10npmThe bee-js release, version 13.3.0, was the latest version on npm for about 75 minutes, from 00:09 to 01:25 UTC today. Its code runs as a postinstall script, which npm executes automatically during installation unlessScreenConnectOn Windows, the downloaded code installs a genuine ScreenConnect remote-access client, signed by its maker, ConnectWise. The client runs as a system service and connects to the attackers' relay.Swarm DesktopAttackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.swarm-cliThe bee-js package is the JavaScript library behind Swarm Desktop and the swarm-cli command-line tool. Swarm Desktop runs a Swarm node on a user's own computer and saves the node's private keys there.