Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

bee-js 13.3.0 and Swarm Desktop 0.56.2

The recent supply chain attack on Ethersphere's Swarm project involved the compromise of its release automation, leading to the distribution of malicious versions of two key tools: bee-js 13.3.0 and Swarm Desktop 0.56.2. The bee-js package, a JavaScript library, was available on npm for approximately 75 minutes, while Swarm Desktop 0.56.2 was on GitHub for about 8.5 hours. These compromised releases were designed to execute malicious code automatically upon installation or application launch, targeting users of the Swarm decentralized storage network.

The attack vector for bee-js was a postinstall script, which npm automatically runs unless explicitly disabled, meaning a project didn't even need to import the library for the code to execute. For Swarm Desktop, the malicious code ran every time the application started. Security firms like Socket and SafeDep quickly identified and analyzed the threat, noting that while the malicious versions were swiftly withdrawn, the damage to already installed systems was not automatically undone, necessitating manual remediation by affected users.

Wallet Key Theft Mechanism

The core functionality of the malware embedded in both compromised releases was to steal sensitive user data, specifically targeting the wallet key and password associated with Swarm Desktop nodes. The malicious code, downloaded from api.frameworkmetrics[.]xyz, sought out config.yaml and data-dir/keys/swarm.key files within Swarm Desktop's data folder. The swarm.key file contains an encrypted Ethereum keystore, but critically, Swarm Desktop stores its unlocking password in plain text within config.yaml.

With both the encrypted key and its plaintext password, attackers could gain full control over a user's Swarm node wallet, enabling them to steal xDAI and xBZZ tokens, chequebook funds, and staked assets. Beyond financial theft, the malware also installed a persistent backdoor. On Linux and macOS, this backdoor was identified as a Go remote shell named evjawbreaker, hidden in a ~/.solidity/ folder and configured to run as a user service or LaunchAgent, providing attackers with remote access to the compromised machine.

Ethersphere's Maintainers and User Actions

Upon discovery, Ethersphere's maintainers acted swiftly to withdraw the malicious releases and issue clean updates. Swarm Desktop 0.56.2 was replaced with version 0.56.3, which was confirmed to be the same code as the previous clean version (0.56.1) but signed with a new Developer ID certificate. Similarly, bee-js 13.3.0 was removed from npm, with 13.2.0 reinstated as the latest version. However, these actions do not automatically remove backdoors or protect already stolen keys.

Users who installed bee-js 13.3.0 or Swarm Desktop 0.56.2 are advised to consider their systems fully compromised. Recommended actions include searching for and clearing cached copies of the malicious packages, pinning to safe versions, and, most critically, treating any affected machine as compromised. This involves rotating all passwords, tokens, and keys from a clean computer, moving funds from compromised Swarm nodes to new keys, and manually removing persistent backdoor components like the ~/.solidity/ folder and associated services. Rebuilding affected machines from trusted images is strongly recommended over attempting in-place cleaning.