A Project's Own Tools Were Used to Steal Wallets

Hackers hijacked a project's release automation to distribute malicious updates that steal crypto wallet keys and install backdoors on user systems.

Attackers have successfully executed a supply chain attack against Ethersphere, the project behind the Swarm decentralized storage network. According to reporting from The Hacker News, the attackers compromised the project's own release automation systems. This allowed them to publish malicious versions of two key developer tools: the JavaScript client library `bee-js` (version 13.3.0) and the `Swarm Desktop` application (version 0.56.2). Instead of legitimate updates, these packages contained malware specifically engineered to steal cryptocurrency assets. The malicious code was designed to locate the wallet key used by the Swarm Desktop node, steal the password that protects it, and then exfiltrate both to an attacker-controlled server. The malware also installed a backdoor, giving the attackers persistent access to the compromised system for future exploitation.

This incident highlights a sophisticated attack vector that targets the heart of the software development lifecycle. Rather than attacking end-users directly through phishing or other common methods, the attackers went upstream to poison the source. By compromising the CI/CD (Continuous Integration/Continuous Deployment) pipeline, they were able to inject their malicious code into the official, trusted software releases. When developers and users downloaded these updates, they were effectively installing the malware themselves, believing it to be a legitimate patch from the project maintainers. This method bypasses many standard security measures because the malicious code is bundled within a signed, official-looking package distributed through normal channels. The trust that users place in a project's official releases becomes the very mechanism of the attack's success.

The Ethersphere supply chain attack is part of a dangerous and growing trend in cybersecurity. It echoes the tactics seen in other high-profile incidents like the SolarWinds breach and various attacks on open-source repositories like NPM and PyPI. Attackers have recognized that compromising a single popular software package or development pipeline provides a much greater return on investment than targeting thousands of individual users. This strategy is particularly effective because it exploits the complex web of dependencies in modern software. A single compromised library can have a cascading effect, infecting countless applications and systems that rely on it. This incident serves as a stark reminder that no project, whether in the decentralized web3 space or traditional enterprise software, is immune to these foundational threats.

For CTOs, security teams, and developers, this attack is a critical call to action. It underscores the urgent need to secure not just the application code itself, but the entire infrastructure that builds, tests, and deploys it. Securing the software supply chain requires a multi-layered defense. This includes enforcing mandatory multi-factor authentication for all developer accounts, especially those with access to release systems, and implementing strict access controls on code repositories and build servers. Furthermore, processes like code signing, reproducible builds, and binary verification become essential for ensuring that the software being shipped is the same as the software that was written and reviewed. Teams must now operate under the assumption that their build environments are a primary target for attackers and invest in the tools and processes needed to protect them from compromise.

This is a severe supply chain attack where the build and release pipeline itself was the weapon. It demonstrates that even with secure code, a compromised automation system can inject malware into trusted software, bypassing many traditional security checks and putting developers at direct risk.

Compromising release automation erodes user trust and can lead to significant financial losses from stolen assets. The incident forces companies to re-evaluate the security of their entire development lifecycle, as a single breach in the pipeline can turn their own products into a liability.