Ethersphere Release-Pipeline Compromise Delivers SleepyDuck-Linked Backdoor via npm and Swarm Desktop

Nov 9, 2026 · Original article ↗

Summary

Socket traced malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 releases to Ethersphere’s compromised release pipeline. Their loaders fetched code from api[.]frameworkmetrics[.]xyz; researchers linked later payloads to SleepyDuck/EtherDuck infrastructure.

Key points

On November 9, 2026, an actor used compromised Ethersphere maintainer and release-automation accounts to publish a malicious bee-js package through trusted publishing and a trojanized Swarm Desktop release through project CI.
The bee-js package added an install-time hook that fetched and executed remote JavaScript with the installing user’s Node.js privileges. The publishing workflow ran the loader three times; what the returned code did beyond a log message could not be determined.
All unpacked Swarm Desktop 0.56.2 packages contained a loader in the Electron main process. Windows and Apple Silicon Mac users could receive the release through auto-update; deleting it did not roll back machines already updated.
Reported later payloads targeted Swarm node configuration and key files; the article says the plaintext configuration password and encrypted wallet key together could expose the node wallet. Payloads also included persistent remote access on macOS and Linux and unattended ScreenConnect access on Windows.
Socket linked the operation to the SleepyDuck/EtherDuck campaigns through a shared Ethereum configuration contract and wallet, matching payload hashes, and identical persistence and ScreenConnect identifiers.
For November 6 credential-harvesting attempts, 38 captured collector requests had empty bodies. Socket assessed with moderate confidence that no data was exfiltrated, but could not explain why an injected workflow payload produced no data or determine the origin of the compromised credentials.
The article recommends bee-js users pin 13.2.0 and rotate credentials accessible to affected environments; Swarm Desktop users should replace 0.56.2 with 0.56.3, check for persistence, and move wallet funds and stakes to a new key from a clean machine.

Article Details

Attack Vectors: The actor used already-compromised GitHub accounts to push malicious commits and trigger releases; the origin of the account compromises remains unexplained.
On November 6, the actor attempted to dump GitHub Actions secrets and inject secret-exfiltration steps into an existing workflow. Captured collector requests had empty bodies, so successful exfiltration was not established.
A modified @ethersphere/bee-js 13.3.0 postinstall hook fetched JavaScript from api[.]frameworkmetrics[.]xyz and executed it with the installing process's Node.js privileges.
A release event published the malicious npm package through Ethersphere's trusted-publishing workflow, which allowed the release path to skip its test and check jobs.
A manually dispatched Swarm Desktop workflow accepted an arbitrary branch and exposed signing and notarization credentials, enabling the actor to build and distribute trojanized releases.
The loaders fetched operating-system-specific payloads. Those payloads attempted to send Bee node configuration and key files to the C2 server and download stage-3 implants.
The macOS and Linux stage-3 backdoor established persistence through a LaunchAgent or systemd user unit and provided a persistent shell; it avoided connecting when it detected a debugger or virtual machine.
On Windows, the payload used UACME method 39 to attempt elevation and installed a configured ScreenConnect client for unattended remote access.
Defensive Notes: Search lockfiles, package-manager caches, and internal registries for @ethersphere/bee-js 13.3.0 and purge cached copies; the article recommends pinning 13.2.0.
Treat developer machines and CI jobs that installed bee-js 13.3.0 with scripts enabled during the reported exposure window as having run the loader, even if installation failed. Rotate accessible credentials, including credentials obtainable through CI OIDC trust.
Check Swarm Desktop logs for version 0.56.2, uninstall it, and install 0.56.3. Linux packages require manual replacement; verify the installed version rather than relying on auto-update.
Assume the Bee node password and key may have been stolen; move node funds, chequebook, and stake to a new key generated from a clean machine.
Hunt for ~/.solidity/, the named LaunchAgent and systemd unit, and the ScreenConnect Client service; reinstalling Swarm Desktop does not remove these artifacts.
Hunt DNS and proxy logs for api[.]frameworkmetrics[.]xyz and the reported hub and relay addresses. Where RPC telemetry is available, monitor calls to the reported Ethereum contract, particularly from binaries under ~/.solidity/.
Require release workflows to verify that the released commit is on a protected branch or came from a merged release pull request; put publishing environments behind required reviewers and restrict deployable tags.
Do not skip tests on the release path or expose signing and notarization credentials to manually dispatched workflows that accept arbitrary branch inputs.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]frameworkmetrics[.]xyz`	Attacker-controlled domain serving loader responses and later-stage payloads.
IPV4	`107[.]189[.]16[.]215`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
IPV4	`107[.]189[.]27[.]223`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
IPV4	`107[.]189[.]27[.]46`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
IPV4	`178[.]16[.]54[.]222`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
IPV4	`185[.]232[.]84[.]169`	ScreenConnect relay used by the attacker-deployed Windows client, on port 8041.
IPV4	`193[.]57[.]9[.]155`	Current implant hub address read from the Ethereum configuration contract, on port 4912.
IPV4	`193[.]57[.]9[.]17`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
IPV4	`91[.]108[.]240[.]156`	Prior implant hub address recorded in the Ethereum configuration contract, on port 4912.
SHA256	`37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e`	SHA-256 of the stage-3 Windows PowerShell loader invoke.ps1.
SHA256	`40a45d68aa49e9e6233c4eb6bb2eb2e92525deea5d17863f6910fc24b06ff20e`	SHA-256 of the Windows app.asar containing the trojanized Swarm Desktop release.
SHA256	`7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da`	SHA-256 of the ScreenConnect installer used by the stage-3 Windows payload.
SHA256	`80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f`	SHA-256 of the darwin_amd64 stage-3 Go backdoor.
SHA256	`92c6eb24f9910b3577d5939a8686f9bf6e52f1bdd5872bf96cab0132b4558025`	SHA-256 of the Linux app.asar containing the trojanized Swarm Desktop release.
SHA256	`9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696`	SHA-256 of the linux_amd64 stage-3 Go backdoor.
SHA256	`b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565`	SHA-256 of the linux_arm64 stage-3 Go backdoor.
SHA256	`d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58`	SHA-256 of the malicious bee-js 13.3.0 npm tarball.
SHA256	`e49afac84dbb6d5a5d101f87754575024b078d67a7ab9e767ff0f7b5b4368069`	SHA-256 of the macOS app.asar containing the trojanized Swarm Desktop release.
SHA256	`ee2f762e9ed3fd89f106e0b80c2e923bf1aed9a280277d3d998a5902c4d9ec0f`	SHA-256 of the modified generate-version.cjs loader shipped in bee-js 13.3.0.
SHA256	`f81315968e679b48f6bdff1c9b928bb223230d07f44d7948412c2250c2a14deb`	SHA-256 of the malicious Swarm Desktop 0.56.2 Electron main-process file.
SHA256	`fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358`	SHA-256 of the darwin_arm64 stage-3 Go backdoor.
URL	`hxxp[:]//107[.]189[.]27[.]46:3000/app[.]js`	Payload URL recorded in the Ethereum configuration contract and associated with the implant operation.
URL	`hxxps[:]//api[.]frameworkmetrics[.]xyz/v1/analytics`	Malicious JavaScript delivery endpoint called by the bee-js install-time loader.
URL	`hxxps[:]//api[.]frameworkmetrics[.]xyz/v1/electron`	Malicious JavaScript delivery endpoint called by the Swarm Desktop loader.
URL	`hxxps[:]//api[.]frameworkmetrics[.]xyz/v1/swarm/report`	Endpoint the stage-2 payload used to send Bee node configuration and key files.