Attackers used stolen CI credentials to publish malicious releases of two Ethersphere tools for the Swarm storage network: bee-js 13.3.0 on npm and Swarm Desktop 0.56.2. Both grab the node’s wallet key and password and try to drop a backdoor on Windows, macOS and Linux.
- bee-js 13.3.0 was the latest on npm for about 75 minutes and ran through a postinstall script, so you didn’t even need to import it.
- Swarm Desktop 0.56.2 was up about 8.5 hours, and the auto-updater could offer it to Windows x64 and Apple Silicon users.
- Both are pulled. Swarm Desktop 0.56.3 is clean, but Linux packages need replacing by hand, and pulling a release doesn’t remove a backdoor that’s already there.
What to do
Search lockfiles, caches, mirrors and CI logs for @ethersphere/bee-js@13.3.0. Pin 13.2.0. If 13.3.0 was installed with install scripts on, the GitHub advisory says to treat that machine as fully compromised. Rotate every secret from a clean box. Consider npm config set ignore-scripts true for CI.
God Bless, and Use the Source!
