Ethersphere Hijacked with SleepyDuck Crypto-Stealing Malware

In November 2026, the Ethersphere ecosystem, a decentralized Ethereum storage protocol, suffered a coordinated supply chain compromise. Threat actors leveraged compromised maintainer credentials to inject malicious loaders into the @ethersphere/bee-js npm package (v13.3.0) and the Swarm Desktop GitHub release (v0.56.2). The campaign successfully utilized the project's own CI/CD pipelines to sign and notarize malicious artifacts, including a macOS build signed with legitimate Apple Developer IDs.

The attack has been linked with high confidence to the SleepyDuck actor (previously associated with malicious Open VSX extensions) due to shared C2 infrastructure and a unique Ethereum-based 'dead drop' resolver. The primary objective appears to be the theft of cryptocurrency wallet keys and the establishment of persistent cross-platform access via the 'evjawbreaker' RAT and unauthorized ScreenConnect instances. Impacted organizations should immediately rotate all credentials accessible from affected CI/CD or developer environments.