Executive Summary
In a sophisticated supply chain attack, adversaries gained unauthorized access to the Ethersphere project's automated release workflows via stolen CI credentials. This access was used to publish malicious versions of two widely used tools: the `@ethersphere/bee-js` (v13.3.0) library and the Swarm Desktop (v0.56.2) application. These malicious releases were designed to exfiltrate Ethereum wallet keys and passwords from local nodes and install persistent backdoors across Windows, macOS, and Linux environments.
The attack leveraged valid project provenance and signing certificates, allowing the malicious Swarm Desktop app to bypass standard security warnings on macOS and Windows. On Linux and macOS, a Go-based remote shell named 'evjawbreaker' was deployed, while Windows machines were infected with a modified ScreenConnect remote-access client. The campaign has been linked with high confidence to the group behind the 'SleepyDuck' malicious VS Code extensions due to shared infrastructure and smart contract-based command-and-control (C2) mechanisms.
This incident highlights the critical risk of insecure CI/CD pipelines and automated publishing workflows. While the malicious versions have been removed and replaced with clean releases (Swarm Desktop v0.56.3), users who installed the compromised versions must consider their systems fully compromised and immediately rotate all credentials and move cryptocurrency assets to new wallets.