Ethersphere’s trusted releases delivered the SleepyDuck loader
Socket says attackers compromised Ethersphere’s release automation on November 9, 2026, publishing two malicious versions: @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2. npm removed the package after about 75 minutes; the desktop release remained available for roughly eight and a half hours.
The npm package changed a script into an installer hook, while the desktop builds carried the same loader in the application’s Electron main process. It fetched JavaScript from a remote server and ran it with full Node.js privileges; later stages used an Ethereum contract tied to the SleepyDuck campaign previously seen in malicious Open VSX extensions. The npm package had valid Supply-chain Levels for Software Artifacts (SLSA) provenance, and the macOS build was signed and notarized. Those checks showed the artifacts came through trusted channels, not that the release automation was safe.
For teams using either product, the compromise puts both package consumers and desktop auto-updater users in scope. Removing the npm package alone does not account for users who received the separate desktop release; the shared risk sat in Ethersphere’s release pipeline.