Ethersphere release pipeline hijacked: bee-js 13.3.0 and Swarm Desktop 0.56.2 laced with wallet-key-stealing malware

Ethersphere maintainers said on GitHub that Swarm Desktop 0.56.2 was built and published by an attacker using stolen CI credentials and has been withdrawn and replaced by 0.56.3 ^[1]. GitHub flagged npm package @ethersphere/bee-js 13.3.0 as malware, and Socket's analysis says both releases fetch and run code that steals the Swarm node's wallet key file and the config file holding its plaintext password ^[2][3]. Any computer that installed bee-js 13.3.0 or ran Swarm Desktop 0.56.2 should be treated as fully compromised, moved to bee-js 13.2.0 or Swarm Desktop 0.56.3, and have all secrets rotated from a separate clean machine ^[2][4].

Organisations running: Ethersphere @ethersphere/bee-js, Ethersphere Swarm Desktop

Any computer that installed bee-js 13.3.0 or ran Swarm Desktop 0.56.2 should be treated as fully compromised, moved to bee-js 13.2.0 or Swarm Desktop 0.56.3, and have all secrets rotated from a separate clean machine ^[2]