{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14736","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-09T00:27:38Z","dateUpdated":"2026-11-09T18:03:25Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"Legitimate, established package whose release automation account appears to have been compromised. Version 13.3.0 was published through the project's real release workflow from an unreviewed commit that added an install-time hook, and only that version is affected. It was removed from npm about 75 minutes later. On install, the hook fingerprints the operating system, fetches code from an attacker-controlled server and runs it with full Node.js privileges. The later stages steal the Bee node password and wallet key and install a persistent remote access backdoor. About 30 minutes after the npm publish, the same account published a malicious release of the project's Swarm Desktop app that contacts the same server, so the two releases are one incident. The command-and-control design, an Ethereum contract that tells the malware where to connect, matches the SleepyDuck campaign.\n\nENTRY\n  scripts/generate-version.cjs (install-hook: node scripts/generate-version.cjs)\n  - Install Hook Executes Local JS File in package.json\n\nDESTINATION\n  - 1 exfil (custom-c2)\n  (values recorded in verified_iocs)\n\nEXFIL\n  - System Information Collection in scripts/generate-version.cjs: \"process.platform\"\n\nADDITIONAL FINDINGS\n  - dep-known-malicious in package.json: \"debug\"\n  - Dynamic Code Execution in scripts/generate-version.cjs: \"new Function('require', 'console', 'process', body)\"\n  - Suspicious TLD Domain in scripts/generate-version.cjs: \"hxxps://api[.]frameworkmetrics[.]xyz\"\n  - Malicious Dependency Detected in package.json\n\nPAYLOAD FILES\n  scripts/generate-version.cjs\n\n## Payload 1: postinstall loader\n\nMalicious payload found in: `scripts/generate-version.cjs`\n\n- Trigger: in 13.3.0 the `prepare` script in `package.json` was renamed to `postinstall` (`node scripts/generate-version.cjs`). No earlier version of the package has an install-time hook. It runs by default on npm 11 and earlier, Yarn Classic and Yarn Berry before 4.14.0. npm 12, pnpm 10+, Yarn Berry 4.14.0+, Bun and Deno skip dependency install scripts by default.\n- Behavior: HTTPS GET to `hxxps://api[.]frameworkmetrics[.]xyz/v1/analytics` with `User-Agent` set to `process.platform` and an `X-Ethersphere: 1` header, then the response body is run with `new Function('require', 'console', 'process', body)`. There is no environment, CI, locale or time check, and the response status is not checked. Without the `X-Ethersphere` header the server returns a decoy.\n- Stage 2: the server returns JavaScript per operating system. It posts the Bee node `config.yaml` (plaintext password) and `data-dir/keys/swarm.key` (encrypted Ethereum keystore) to `hxxps://api[.]frameworkmetrics[.]xyz/v1/swarm/report`, then downloads stage 3 from `/v1/assets/` on the same host.\n\n## Payload 2: stage 3 backdoor\n\nMalicious payload found in: platform binaries written to `~/.solidity/` (for example `linux_amd64`, `darwin_arm64`) and `invoke.ps1` on Windows\n\n- macOS and Linux: a Go backdoor (module `evjawbreaker`) started by `~/.solidity/.run.py` (or `.run.cjs` on macOS when Node.js is present). Persistence is the systemd user unit `solidity-langsupport-runner.service` or the LaunchAgent `com.solidity.langsupport.runner`. It exits if a debugger or VM is detected. It reads its hub address from an Ethereum contract through the public RPC gateways `rpc[.]ankr[.]com` and `cloudflare-eth[.]com`, connects to the hub on port 4912 over TLS without certificate validation, and runs operator commands in a persistent `sh` pty.\n- Windows: an obfuscated PowerShell loader (`invoke.ps1`) stages files under `%TEMP%\\.stuffed-*`, bypasses UAC with UACME method 39 (COR_PROFILER against `mmc.exe`), adds a Microsoft Defender exclusion, and silently installs ConnectWise-signed ScreenConnect 25.4.3 configured for the relay `185[.]232[.]84[.]169:8041` with the tray icon and banners hidden. It runs as the SYSTEM service `ScreenConnect Client (5cbe79c9c25524df)`.\n- C2 configuration: the hub address and payload URL are stored on an Ethereum mainnet contract that only the operator wallet can change, so the hub moves without changing the package.\n","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/fd37c5d9-00c5-4631-973e-272a17e70af0","name":"Malicious npm package: @ethersphere/bee-js","tags":["advisory"]},{"url":"https://registry.npmjs.org/@ethersphere/bee-js","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"@ethersphere/bee-js","collectionURL":"https://registry.npmjs.org","packageName":"@ethersphere/bee-js","repo":"","defaultStatus":"affected","versions":[{"version":"13.3.0","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}