Ethersphere's Swarm Targeted by Supply Chain Attack

On November 9, 2026, the development team Ethersphere, responsible for the decentralized storage project Swarm, was targeted in a supply chain attack. Attackers published a compromised version of the bee-js library (version 13.3.0) to npm and pushed a trojanized update for Swarm Desktop (version 0.56.2) through auto-updates. This malicious software was designed to read Bee node configuration files and encrypted wallet keystores, which contained plaintext passwords, and exfiltrate this sensitive information. Additionally, the malware installed a remote-access backdoor.

The versions of the compromised software have since been removed from npm and the project, and there have been no confirmed losses of funds reported as a result of this incident. The attack highlights the risks associated with supply chain vulnerabilities in software development, particularly in decentralized projects like Swarm. The incident did not result in any financial loss, but it raises concerns about the security of user data and the integrity of software updates.