Search — “SleepyDuck”

Attackers using stolen CI credentials (bee-worker account) published bee-js 13.3.0 to npm and Swarm Desktop 0.56.2 via the project's signed build workflows. A loader fetches code from api.frameworkmetrics[.]xyz that exfiltrates config.yaml and swarm.key, installs a Go remote shell (evjawbreaker) on Linux/macOS under ~/.solidity with systemd/LaunchAgent persistence, and on Windows uses a UAC bypass, adds a Defender exclusion and installs a ScreenConnect client. No infection count or fund theft reported; hunt for npm postinstall network calls, ~/.solidity, the persistence units, and unexpected ScreenConnect services.