Decentralized storage project Swarm software compromised by malware designed to steal wallet data

on November 10, security research team Socket disclosed that attackers exploited Ethersphere’s release process to implant malicious code into the npm package @ethersphere/bee-js 13.3.0 and the Swarm Desktop 0.56.2 desktop application.

According to Socket’s analysis, the malicious loader downloads and executes remote code, with subsequent payloads reading Swarm Desktop’s configuration files and node wallet keys. The affected desktop version was released through the project’s own build pipeline and had previously been distributed to some users via automatic updates. npm has removed the affected package versions.