Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

On November 9, 2026, a threat actor compromised the Ethersphere project's release pipeline by gaining access to maintainer accounts and publishing a malicious @ethersphere/bee-js 13.3.0 package to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub. Both artifacts contain a loader that fetches and executes JavaScript from api.frameworkmetrics.xyz, leveraging the same infrastructure previously used in the SleepyDuck/EtherDuck Open VSX campaign. The attack reused an Ethereum smart contract (0xf8a900Db...) for command-and-control, allowing the actor to exfiltrate node wallet credentials and deploy a persistent Go-based backdoor or ScreenConnect for remote access. npm removed the malicious package after 75 minutes, but the GitHub release remained for over eight hours, impacting users who auto-updated.

AI-extracted · verify before operational use