What Happened
Attackers abused Ethersphere’s release automation to publish bee-js 13.3.0 on npm and Swarm Desktop 0.56.2 on GitHub, The Hacker News reports. Both releases steal the node wallet key and password and install a backdoor. The npm version stayed live for about 75 minutes. Swarm Desktop 0.56.2 was available for about 8.5 hours, and its built-in updater offered it to Windows and Apple Silicon users within minutes.
The bee-js loader runs as a postinstall script, so installing the package is enough. On Linux and macOS it drops a Go remote shell. On Windows it installs a genuine ScreenConnect client. Maintainers blame stolen CI credentials. The publish workflow needed no approval and ran in 73 seconds. Because the real workflow built the package, it carried valid npm provenance. Socket, SafeDep, and Pluto Security analyzed the incident. Pluto links it to the SleepyDuck extensions from September.
Why This Matters for Canadian Organizations
Download counts were small, about 10 for bee-js and 65 for Swarm Desktop. The lesson reaches further. Valid provenance did not signal a clean package. Any Canadian team publishing npm packages or desktop builds through CI with no human approval has the same exposure.
Developer machines hold cloud keys, source code, and customer data. A postinstall script runs with the developer’s rights. Regulated firms under OSFI Guideline B-13 and PIPEDA owe customers proof of control over software supply chains.
What to Do
Search lockfiles and build logs for bee-js 13.3.0 and Swarm Desktop 0.56.2. Move to bee-js 13.2.0 and Swarm Desktop 0.56.3. Treat any machine running either release as compromised, and move wallet funds to a new key. Add required approvals to your own publish and signing jobs. Scope CI tokens to the narrowest rights and rotate them often. Set npm installs to skip install scripts where builds allow it. Read more TechTalk coverage and our latest news.
