Swarm Developer Package and Desktop App Hit by Supply-Chain Attack, Node Wallet Keys May Be Exposed

Swarm development team Ethersphere was hit by a supply-chain attack affecting its developer package and desktop application. According to Odaily, attackers published a malicious version of bee-js, version 13.3.0, to npm on November 9 and used automatic updates to distribute a trojanized version of Swarm Desktop 0.56.2. The malicious code could read Bee node configuration files and encrypted wallet keystores, then send them to the attackers. Because the configuration files store keystore passwords in plaintext, node wallets may be exposed; the code also installed a remote-access backdoor on affected devices. npm has removed the package version, and Ethersphere has withdrawn the affected desktop version. No financial losses have been confirmed.