Swarm development
Security firm Socket disclosed that Swarm development team Ethersphere suffered a supply chain attack: on November 9, the attacker published malicious bee-js 13.3.0 to npm and pushed a trojanized Swarm Desktop 0.56.2 through auto-updates, capable of stealing Bee node wallet keys and implanting a backdoor. The affected versions have been removed and taken down, with no confirmed financial losses so far.
Event Timeline
- [11-09 18:56] Decentralized storage project Swarm's development package and desktop client poisoned, can steal node wallets (PANews)
- [11-09 18:57] Node wallet keys may have been stolen, Swarm development package and desktop client poisoned (Odaily)
Background and Impact
On November 9, 2026, security firm Socket disclosed that Ethersphere, the development team of decentralized storage project Swarm, suffered a supply chain attack. According to Socket information cited by PANews and Odaily, the attacker published a malicious version of bee-js 13.3.0 to npm that day and, through the auto-update mechanism, pushed a trojanized Swarm Desktop 0.56.2. The two sources differ slightly in how they describe the source of the information: PANews said Socket published an analysis report, while Odaily said it was detected by Socket monitoring.
According to the disclosed technical details, the malicious code reads the Bee node's configuration file and encrypted wallet keystore, and sends the contents back to the attacker. Because the configuration file stores the keystore password in plaintext, the node wallet may be exposed as a result. In addition to stealing key material, the malicious code also implants a remote-control backdoor on the device. The risk appears on two paths: the development package dependency and the desktop client — the former targeting developers who integrate the library, the latter targeting node operators who use auto-updates.
In terms of response, npm has removed bee-js 13.3.0, and Ethersphere has also taken down the relevant desktop version. Both sources mentioned that there are currently no confirmed financial losses. Socket recommends that affected users uninstall the relevant versions, generate new keys on a clean device, and then move wallet funds and staking.
Based on available information, the exposure is concentrated among users running Bee nodes and using the above versions of the development package or desktop client; for users who only hold the relevant tokens and do not participate in node operation, the materials do not mention direct impact. The characteristic of supply chain poisoning is that the attacker does not need to touch the target device — a single version release can spread through auto-updates. Therefore, the acquisition channels, version numbers, and verification information for software and plugins are worth checking item by item. The same applies to downloads of crypto asset-related applications, including Huobi HTX registration APP download, Zhima Gate.io registration APP download, Bitget registration APP download, Binance registration APP download, OKX registration APP download, and other steps — all should be confirmed through official channels rather than relying on search results or third-party links. As of press time, there is no public information on the number of affected nodes or whether the incident has further spread.
FAQ
### Which users need to take immediate action?
Developers and Bee node operators who have used bee-js 13.3.0 or upgraded to Swarm Desktop 0.56.2 through auto-updates. Socket recommends uninstalling the relevant versions, generating new keys on a clean device, and moving wallet funds and staking.
### Have there been any financial losses so far?
Both sources said there are currently no confirmed financial losses, and the materials did not disclose the number of affected nodes or specific amounts. Whether losses occur later should be determined by updates from Ethersphere and security firms.
### Why is the plaintext password in the configuration file a relatively large risk?
The Bee node configuration file stores the keystore password in plaintext, and the malicious code reads both the configuration file and the encrypted wallet keystore; combining the two can restore wallet access, so simply changing the password is not enough to address the issue.