Attackers used the Ethersphere project’s own release automation to publish malicious versions of two tools for the Swarm decentralized storage network: the bee-js JavaScript library, version 13.3.0, and the Swarm Desktop app, version 0.56.2. According to The Hacker News and security firm SafeDep, both releases download and run code that steals the wallet key and stored password of the Swarm node and installs a backdoor on Windows, macOS and Linux. Both releases have been withdrawn, but that does not remove a backdoor already installed or bring back a key already sent. The Hacker News said no theft of funds had been reported at the time of writing.
The bee-js release was the latest version on npm for about 75 minutes (00:09 to 01:25 UTC on November 9), and its code runs as a postinstall script, so a project did not need to import the library for it to run. SafeDep says the release carried a valid npm provenance attestation and was made by the project’s release bot, which points to a compromised bot account or token rather than a stolen npm token; a maintainer’s note, as quoted by The Hacker News, says 0.56.2 “was published by an attacker using stolen CI credentials.” Swarm Desktop 0.56.2 appeared on GitHub at about 00:36 UTC and was withdrawn roughly 8.5 hours later; according to Socket’s analysis as relayed by The Hacker News, its built-in updater could offer it to Windows x64 and Apple Silicon Mac installs within about 10 minutes, Intel Macs were never offered it, and Linux installs do not update automatically. No count of infected machines has been published. SafeDep says the latest bee-js on npm is again the clean 13.2.0, and the maintainers released a clean Swarm Desktop 0.56.3 (the same code as 0.56.1, signed with a newly issued certificate, per the maintainer’s note as quoted by The Hacker News).
How to check if you’re affected
Affected versions are bee-js 13.3.0 and Swarm Desktop 0.56.2. The swarm-cli and bee-dashboard packages and the Swarm Desktop source accepted version ranges that included 13.3.0, so a fresh install in that window could have pulled it in. GitHub’s advisory (GHSA-hh7j-5m3j-23pf) says any computer that has the package installed or running should be considered fully compromised, and that its secrets and keys should be rotated from a different computer.
- Projects and CI: search lockfiles, package caches, internal registries and CI install logs for
@ethersphere/bee-js@13.3.0, including copies pulled in by other packages. Pin 13.2.0 and clear cached copies of 13.3.0. If 13.3.0 was installed with install scripts enabled, The Hacker News advises treating that machine or runner as compromised and rotating every password, token and key the installing user or job could read. - Swarm Desktop: look for the line
Bee Desktop version: 0.56.2 (production)inbee-desktop.log(macOS:~/Library/Logs/Swarm Desktop/; Windows:%LOCALAPPDATA%\Swarm Desktop\Log\; Linux:~/.local/state/Swarm Desktop/). Install 0.56.3 (on Linux, replace the package by hand). If 0.56.2 ever ran, treat the node’s key and password as stolen and, from a clean computer, move funds, chequebook and stake to a new key. - Persistence: SafeDep lists the backdoor locations as the
~/.solidity/folder and thesolidity-langsupport-runner.serviceuser service on Linux, thecom.solidity.langsupport.runnerLaunchAgent on macOS, and a hidden ScreenConnect client on Windows. The Hacker News notes that updating or removing the app or package does not remove them, and that rebuilding the machine from a trusted image is preferable to cleaning it in place.
Sources
- The Hacker News: Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
- SafeDep: Compromised bee-js and Swarm Desktop Steal Swarm Wallet Keys
- GitHub Advisory Database: Malware in @ethersphere/bee-js (GHSA-hh7j-5m3j-23pf)
- Swarm Desktop release v0.56.3
- Socket’s incident analysis (socket.dev) is linked from The Hacker News; the page returned a bot challenge, so its details are as relayed by The Hacker News.