Decentralized Storage Network Swarm Developer Ethersphere Hit by Supply Chain Attack; Malicious Packages Distributed via Official GitHub Pipeline
Ethersphere suffered a supply chain attack due to compromised CI credentials, allowing malicious versions of bee-js and Swarm Desktop to be distributed through official channels, stealing wallet keys and installing backdoors.
Ethersphere, the development organization behind the decentralized storage network Swarm, recently fell victim to a software supply chain attack. Attackers exploited vulnerabilities in the project's GitHub release process to publish a malicious JavaScript package, bee-js 13.3.0, on NPM, and released a compromised version of the desktop application, Swarm Desktop 0.56.2. These malicious versions are capable of stealing node wallet keys and installing remote control backdoors on users' computers.
According to an investigation by security firm Socket, project maintainers and automated release accounts were likely compromised, though the initial method of credential leakage remains unclear. The attackers used stolen CI credentials to publish malicious versions via the compromised bee-worker account on GitHub. Because the original automated release process did not verify whether code came from protected branches and skipped tests when publishing new versions via GitHub, the attackers were able to use official GitHub Actions to push the malicious packages to NPM.
Technically, the attackers added a postinstall script to bee-js 13.3.0 that downloads and executes JavaScript from an external server during installation. As long as the package manager allows execution of install scripts, the attack can trigger even if developers do not directly use bee-js functionality. Reports indicate that this malicious loader executed three times within Ethersphere's own NPM release jobs.
Swarm Desktop 0.56.2 was embedded with malicious code that automatically connects to an attacker-controlled server to download and execute remote JavaScript every time the application starts. Subsequent malware attempts to read Swarm node wallet key files and configuration files storing unlock passwords, sending them to the attackers. It also installs backdoors depending on the operating system: the Windows version abuses the legitimate tool ScreenConnect for remote access, while macOS and Linux versions implant Go-language backdoors that retrieve control server addresses via Ethereum smart contracts. Related contracts share infrastructure with previous SleepyDuck attack campaigns.