The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
- Published
- Record updated
Summary
Socket's Threat Research Team analyzed the November 9, 2026 compromise of Ethersphere's release pipeline, in which a threat actor used the project's own GitHub automation to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub. Both artifacts carry a loader that fetches JavaScript from api[.]frameworkmetrics[.]xyz and executes it with full Node.js privileges, and the later stages take their C2 address from Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, the same infrastructure documented in the SleepyDuck / EtherDuck Open VSX campaign.