Swarm dev packages and desktop app backdoored in supply chain attack that can steal node wallets

November 10: According to an analysis report released by security firm Socket, Ethersphere, the development team behind decentralized storage project Swarm, has suffered a supply chain attack. On November 9, the attacker published a malicious version of bee-js 13.3.0 to npm and pushed a trojanized Swarm Desktop 0.56.2 through automatic updates. The malicious code reads the Bee node's configuration file and encrypted wallet keystore and sends them back to the attacker; because the keystore password is stored in plaintext in the configuration file, node wallets may be exposed, and a remote-control backdoor is also implanted on the device. npm has since removed the version, Ethersphere has also withdrawn the relevant desktop version, and no fund losses have been confirmed. Socket advises affected users to uninstall the relevant versions, generate new keys on a clean device, and move wallet funds and staking.