Swarm Tools Hijacked: Trusted Software Updates Used to Spread Wallet-Stealing Malware

Attackers used the Ethersphere project's own release automation to publish two malicious tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both download and run code designed to steal the wallet key that Swarm Desktop keeps for its node, along with the password that unlocks it. The code is also built to install a backdoor on Windows, macOS and Linux. One maintainer wrote that 0.56.2 was published using stolen CI credentials.

The exposure windows were short. The bee-js release was the latest version on npm for about 75 minutes. Its code ran automatically during installation through a postinstall script, so a project did not need to use the library for the code to run. Several related packages accepted version ranges that included 13.3.0, so a fresh install in that window could have pulled it in. Swarm Desktop 0.56.2 stayed on GitHub for about 8.5 hours. According to Socket, its built-in updater could offer it to Windows x64 and Apple Silicon Mac computers within about 10 minutes. Intel Macs were never offered it, and Linux installs do not update automatically.

Both malicious releases have been withdrawn and a clean Swarm Desktop version, 0.56.3, is available. However, this does not remove a backdoor already installed or protect a key already stolen. No theft of funds had been reported at the time of writing, and no count of infected machines was given. Socket roughly estimates bee-js 13.3.0 was downloaded about 10 times, and Swarm Desktop 0.56.2 reached 65 downloads, including researchers.