Ethersphere project targeted in supply chain attack | brief

Attackers compromised the Ethersphere project by leveraging its internal release automation to distribute malicious versions of the bee-js library and Swarm Desktop application, as first reported by The Hacker News.

The malicious releases, identified as bee-js version 13.3.0 and Swarm Desktop version 0.56.2, were designed to exfiltrate sensitive wallet keys and passwords from user systems. Upon execution, the malware installs persistent backdoors on Windows, macOS and Linux machines. The attack utilized stolen continuous integration credentials to bypass security checks, allowing the malicious code to carry valid provenance records. While the compromised versions have been removed and replaced with clean updates, security experts warn that these measures do not automatically remediate existing infections. The payload shares infrastructure with the SleepyDuck malware, suggesting the involvement of a sophisticated threat actor. Users are advised to treat any machine that ran the affected software as fully compromised, rotate all exposed credentials and perform a clean rebuild of affected systems. The incident highlights the significant risks associated with automated software supply chains and the potential for attackers to exploit trusted build pipelines to deliver malicious payloads to unsuspecting users.

Source: The Hacker News