Ethersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malware
Attackers used the Ethersphere project's own release automation to publish malicious bee-js 13.3.0 and Swarm Desktop 0.56.2, according to the report. The code is described as stealing the wallet key and stored password for Swarm Desktop nodes and installing a backdoor.
Written by a model from the sources below. Verify against them.
- Kind
- Malicious package
- Vendor
- Ethersphere
- Product
- bee-js
- Status
- Reported, not confirmed
- First seen
What to do
Do not install or run bee-js 13.3.0 or Swarm Desktop 0.56.2
Move funds from any Swarm Desktop node wallet to a new key you create on a clean system
Check systems that ran these versions for a backdoor and rotate exposed passwords
Reinstall from a verified official release once the project confirms a clean build
Timeline
- Made public by Mastodon
- First seen by cve.now
Evidence 2
- SocialMastodon
“The @ethersphere/bee-js npm package version 13.3.0 was published with malicious code that executes during installation.”
- PressThe Hacker News
“Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-5ab74d9eed
Has Ethersphere confirmed it?
Mastodon and The Hacker News report it. No statement from Ethersphere has reached cve.now yet.Source: Mastodon, The Hacker News
What should Ethersphere users do?
Do not install or run bee-js 13.3.0 or Swarm Desktop 0.56.2. Move funds from any Swarm Desktop node wallet to a new key you create on a clean system. Check systems that ran these versions for a backdoor and rotate exposed passwords. Reinstall from a verified official release once the project confirms a clean build.