Wallet-stealing malware injected into official Ethersphere releases
Ethersphere's automated release process was compromised, and malware was injected into bee-js 13.3.0 and Swarm Desktop 0.56.2. The attacker used stolen release automation credentials to distribute malicious versions through legitimate npm releases and desktop update channels. The malware was designed to steal wallet keys and passwords and install backdoors on Windows, macOS, and Linux, while the extent of actual infections and asset theft remains unknown.
Key facts
- Affected organisation
- Ethersphere
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Compromise of the official release pipeline using stolen release automation credentials
- Location
- Other countries
Timeline
- Wallet-stealing malware was discovered in the official releases of bee-js 13.3.0 and Swarm Desktop 0.56.2.
- It was revealed that malicious versions had been distributed through legitimate npm releases and desktop update channels.
5 related reports
- Ethersphere Hijacked With Crypto Stealing Malware Via Github & npm
- Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware
- Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor
- Ethersphere project targeted in supply chain attack
- Hackers hijack Ethersphere’s bee-js package and Swarm Desktop app to push wallet-stealing malware
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.