According to Socket monitoring cited in an Odaily roundup published on November 10, 2026, at 08:29:56 UTC+8, Swarm developer Ethersphere suffered a supply-chain attack affecting its JavaScript development package and desktop application.
The report said attackers published malicious bee-js version 13.3.0 to npm on November 9 and distributed a trojanized Swarm Desktop version 0.56.2 through automatic updates.
Potential access to node wallets
According to the report, the malicious code read Bee node configuration files and encrypted wallet keystores, then sent them to the attackers. Because the configuration files stored keystore passwords in plaintext, node wallets may have been exposed. The report also said the malware installed a remote-control backdoor on affected devices.
The reported risk concerned access to node operators’ wallet credentials; the source did not establish that attackers had used those credentials to move funds.
Affected releases withdrawn
At the time of the report, npm had removed the malicious package version, and Ethersphere had withdrawn the affected desktop release. No fund losses had been confirmed.