If a Swarm Bee node wallet holds funds or staking you cannot afford to expose, the practical question is whether a poisoned update ever reached that machine.
Foresight News reported on 10 November 2026 at 08:47 (UTC+8), citing Socket’s monitoring, that Swarm’s development team Ethersphere had been hit by a supply-chain attack. According to that account, an attacker published malicious bee-js 13.3.0 to npm on 9 November and, through automatic updates, pushed trojanized Swarm Desktop 0.56.2.
Socket said the malicious code reads a Bee node’s configuration file and its encrypted wallet keystore and sends them back to the attacker. It also implants a remote-control backdoor on the device. The keystore is encrypted, but the keystore password is stored in plaintext in the configuration file, so the node wallet may be exposed once both are copied. Keeping that password in the config makes the node easier to unlock without entering a separate secret—an accessibility choice—while giving up the confidentiality the encryption was meant to provide. The report does not describe any separate protection that would have kept the copied keystore unusable.
Foresight News said npm had removed that package version and Ethersphere had withdrawn the related desktop release. As of the report, there were no confirmed fund losses. That is an absence of confirmed losses, not an estimate of how much may have been taken.
Socket’s advice for affected users, as relayed by Foresight News, is to uninstall the related versions and, on a clean device, generate new keys and transfer wallet funds and staking. A clean device matters because the same report describes a backdoor on the machine that ran the poisoned build. New keys and a transfer do not show that an attacker never received the old keystore, and they do not remove all custody risk.
Original article: Foresight News (published 10 November 2026, 08:47 UTC+8).
