Socket’s November 9 investigation identifies malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 releases delivered through Ethersphere’s own automation. Later payloads reused infrastructure associated with the SleepyDuck/EtherDuck campaigns, including an Ethereum contract used to locate command-and-control servers.
The package carried valid build provenance. The affected macOS application was signed and notarized. Those checks establish aspects of origin and distribution; they do not establish that the released source was reviewed or safe.
SafeDep’s separate analysis found wallet-key theft followed by persistent remote access. Linux and macOS received a Go implant; Windows received a configured ScreenConnect client. The targeted Swarm node files included both an encrypted wallet key and its password, making their combination sensitive.
Replacement is only one part of recovery
The official Swarm Desktop 0.56.3 release, published November 9, explicitly replaces compromised 0.56.2. Socket recommends bee-js users pin 13.2.0 and remove malicious copies from caches and mirrors. Linux desktop packages require manual replacement.
SafeDep advises treating exposed machines as compromised and investigating the installed backdoors. Its indicators include a ~/.solidity/ directory, a systemd user service or macOS LaunchAgent, and a distinct ScreenConnect service instance on Windows. Socket warns that reinstalling the application does not remove those persistence mechanisms.
