Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor

In November 2026, threat actors compromised Ethersphere's release pipeline, publishing malicious versions of the @ethersphere/bee-js npm package and Swarm Desktop releases. These trojanized artifacts contained loaders that fetched JavaScript with full Node.js privileges from a malicious server and used an Ethereum smart contract for command and control. The malware exfiltrated sensitive data such as Bee node passwords and wallet keys, and deployed backdoors and remote access tools targeting developers working with Ethereum tooling. The compromised releases were signed and published through legitimate workflows, making detection more difficult.

• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07