Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

Socket’s investigation found that compromised Ethersphere GitHub accounts and release automation were used to publish the malicious npm package @ethersphere/bee-js 13.3.0 and trojanized Swarm Desktop 0.56.2 on November 9, 2026. Both releases contained loaders that contacted frameworkmetrics.xyz and executed remotely supplied JavaScript with the privileges of the installing Node.js environment or Electron application, despite being produced through legitimate CI workflows; the npm package had valid SLSA provenance, while the desktop application was signed and, on macOS, notarized. The npm release was available for about 75 minutes, while the desktop release remained public for roughly eight and a half hours and was distributed to eligible macOS and Windows users through automatic updates. Subsequent payloads reportedly stole Swarm node configuration files and encrypted wallet keys along with their plaintext passwords, then installed persistent remote-access tooling on affected systems. The command infrastructure, Ethereum smart-contract dead-drop mechanism, payloads, persistence names, and ScreenConnect configuration matched those previously associated with the SleepyDuck/EtherDuck malicious Open VSX extension campaign. The report recommends treating systems that installed the affected versions as compromised, rotating accessible credentials, moving wallet funds to new keys, checking for persistence artifacts, and strengthening release controls through protected branches, required approvals, tag restrictions, and safer handling of signing and publishing credentials.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.