Ethersphere Supply Chain Attack: Malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 Deliver Wallet-Stealing Malware — Detection and Response Guide

---
title: Node.js or npm Process Accessing Swarm Desktop Keystore
description: Detects Node.js, npm, or Swarm Desktop processes reading Swarm wallet keystore files, consistent with the bee-js 13.3.0 / Swarm Desktop 0.56.2 wallet theft payload.
references:
  - https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/11/10
status: experimental
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\swarm-desktop\'
      - '\.swarm\'
      - '\bee\keys\'
  selection_sensitive:
    TargetFilename|contains:
      - 'keystore'
      - 'wallet'
      - 'password'
  filter_legit:
    Image|endswith:
      - '\swarm-desktop.exe'
      - '\bee.exe'
  condition: selection_path and selection_sensitive and not filter_legit
falsepositives:
  - Legitimate Swarm tooling upgrades touching keystore directories
level: high
---
title: Swarm Desktop or Node.js Spawning Script or Download Child Processes
description: Detects Swarm Desktop or Node.js/npm processes spawning shells, script interpreters, or download utilities, consistent with the second-stage payload retrieval and backdoor installation observed in the Ethersphere supply chain compromise.
references:
  - https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/11/10
status: experimental
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\swarm-desktop.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate npm lifecycle scripts during package installation
  - Swarm Desktop update mechanisms spawning shell commands
level: medium
---
title: npm Postinstall Script Performing Network Download of Executable Content
description: Detects Node.js child processes fetching remote content during package installation, consistent with the bee-js 13.3.0 install-time payload retrieval behavior.
references:
  - https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/11/10
status: experimental
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'node -e'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'curl '
      - 'wget '
      - 'certutil -urlcache'
  filter_registry:
    CommandLine|contains:
      - 'registry.npmjs.org'
  condition: selection and not filter_registry
falsepositives:
  - Build pipelines that legitimately fetch tooling during npm install
level: medium

let lookback = 30d;
let SwarmPaths = dynamic(["swarm-desktop", ".swarm", "bee"]);
let SuspiciousChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "certutil.exe"]);
union
(DeviceProcessEvents
| where TimeGenerated >= lookback
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "swarm-desktop.exe", "bee.exe")
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| extend Hunt = "Swarm/Node spawned suspicious child"),
(DeviceProcessEvents
| where TimeGenerated >= lookback
| where ProcessCommandLine has_any (SwarmPaths)
   and ProcessCommandLine has_any ("keystore", "wallet", "password", "keys")
| where not(InitiatingProcessFileName in~ ("swarm-desktop.exe", "bee.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| extend Hunt = "Non-Swarm process referencing wallet material"),
(DeviceNetworkEvents
| where TimeGenerated >= lookback
| where InitiatingProcessFileName in~ ("node.exe", "swarm-desktop.exe")
| where not(RemoteUrl has_any ("registry.npmjs.org", "github.com", "ethswarm.org", "swarm"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend Hunt = "Swarm/Node outbound to non-standard destination")
| order by TimeGenerated desc

-- Ethersphere bee-js 13.3.0 / Swarm Desktop 0.56.2 compromise hunt
-- Identifies suspicious Node/Swarm child processes and wallet material access
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
  -- Node or Swarm spawning shells, downloaders, or script engines
  (CommandLine =~ '(?i)node|swarm-desktop|bee'
     AND CommandLine =~ '(?i)powershell|cmd\.exe|curl|wget|rundll32|regsvr32|mshta|wscript')
  OR
  -- Any process referencing Swarm keystore/wallet paths
  CommandLine =~ '(?i)swarm-desktop|\.swarm'
     AND CommandLine =~ '(?i)keystore|wallet|password|keys'
)
-- Enrich with parent context
LET parents = SELECT Pid AS ParentPid, Name AS ParentName, Exe AS ParentExe
  FROM pslist()
SELECT * FROM {
  SELECT a.*, p.ParentName, p.ParentExe
  FROM scope() a
  LEFT JOIN parents p ON a.Ppid = p.ParentPid
}

#Requires -RunAsAdministrator
# Ethersphere supply chain compromise - triage and containment
# Checks for bee-js 13.3.0 and Swarm Desktop 0.56.2 exposure

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Check globally and locally installed npm packages for malicious bee-js version
Write-Host '[*] Checking for bee-js 13.3.0 in npm dependency trees...' -ForegroundColor Cyan
$npmRoots = @("$env:APPDATA\npm\node_modules", "$env:ProgramFiles\nodejs\node_modules")
$npmRoots += Get-ChildItem -Path "C:\Users\*\*\node_modules" -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
foreach ($root in $npmRoots | Select-Object -Unique) {
    $pkg = Join-Path $root 'bee-js\package.json'
    if (Test-Path $pkg) {
        $ver = (Get-Content $pkg -Raw | ConvertFrom-Json).version
        if ($ver -eq '13.3.0') {
            $report += [pscustomobject]@{ Finding = 'MALICIOUS bee-js 13.3.0'; Path = $pkg; Severity = 'CRITICAL' }
            Write-Host "[!!] Malicious bee-js 13.3.0 found at $pkg" -ForegroundColor Red
        }
    }
}

# 2. Check installed Swarm Desktop version
Write-Host '[*] Checking Swarm Desktop version...' -ForegroundColor Cyan
$swarm = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object { $_.DisplayName -like '*Swarm*' }
foreach ($app in $swarm) {
    if ($app.DisplayVersion -eq '0.56.2') {
        $report += [pscustomobject]@{ Finding = 'MALICIOUS Swarm Desktop 0.56.2'; Path = $app.InstallLocation; Severity = 'CRITICAL' }
        Write-Host '[!!] Malicious Swarm Desktop 0.56.2 installed' -ForegroundColor Red
    }
}

# 3. Sweep user-writable persistence locations for recently created executables
Write-Host '[*] Sweeping persistence locations for recent artifacts...' -ForegroundColor Cyan
$window = (Get-Date).AddDays(-45)
$persistPaths = @("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup", "$env:LOCALAPPDATA\Temp")
foreach ($p in $persistPaths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.js -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt $window } |
        ForEach-Object { $report += [pscustomobject]@{ Finding = 'Recent executable in persistence path'; Path = $_.FullName; Severity = 'REVIEW' } }
}
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' |
    ForEach-Object { $_.PSObject.Properties } | Where-Object { $_.Name -notlike 'PS*' } |
    ForEach-Object { Write-Host "    Run key: $($_.Name) = $($_.Value)" }

# 4. Pin/block malicious versions via npm overrides (defense in depth)
Write-Host '[*] Adding npm audit block guidance: pin bee-js to a known-good release.' -ForegroundColor Cyan

$report | Format-Table -AutoSize
if ($report | Where-Object Severity -eq 'CRITICAL') {
    Write-Host '[ACTION REQUIRED] Malicious version detected. Isolate host, rotate wallet keys, begin IR.' -ForegroundColor Red
    exit 1
} else {
    Write-Host '[OK] No malicious Ethersphere versions detected on this host.' -ForegroundColor Green
    exit 0
}