Trojanized Swarm Releases Exposed Bee Node Wallet Credentials

Malicious releases of the Swarm Bee JavaScript package and Swarm Desktop were built to steal node wallet credentials and install a remote-control backdoor, security firm Socket found. The trojanized code reached npm on Monday, Nov. 9, and then spread to desktop users through automatic updates.

The compromised package was bee-js 13.3.0. It sat on npm long enough for developers to pull it. Alongside it, a malicious Swarm Desktop 0.56.2 reached end users via the app's automatic update channel — the more dangerous of the two paths, because it required no action from the victim.

The malicious code did two things. First, it read Bee node configuration files and encrypted wallet keystores, then sent that data to the attackers. Second, the desktop variant installed a remote-control backdoor on affected devices, giving attackers persistent access.

The credential exposure was worse than it sounds. The configuration files stored the keystore password in plain text. That means anyone holding the exfiltrated data could unlock the encrypted wallet file and take control of node wallets outright.

No financial losses have been confirmed so far.

What should affected users do now?

The response has been containment first, remediation second. The malicious npm release has been removed. Ethersphere, the team behind Swarm, withdrew the affected desktop version.

For users who ran the compromised releases, the recommended path is strict:

• Uninstall the compromised releases entirely
• Generate new keys on a clean device, not the infected one
• Transfer wallet funds and staked assets to the newly generated wallets

The clean-device requirement matters here. Because the desktop malware installed a remote-control backdoor, a machine that ran the trojanized build cannot be trusted to hold new keys. Anything generated on it may be visible to the attacker.

Why supply-chain attacks hit node operators hard

Swarm is a decentralized storage project, and Bee is its node software. That makes node operators the direct victims of this attack — the people running infrastructure, holding wallets, and in many cases staking assets to participate in the network.

Package registries like npm are a recurring weak point. A single compromised release, signed and versioned like any legitimate one, can travel through the same automatic update channels that normally keep software safe. Here the update mechanism became the delivery vector.

The pattern is familiar from prior incidents, but the target profile is specific: node operators with live wallets and staked positions, not casual users. Exfiltrated keystores plus plain-text passwords give an attacker everything needed to move funds at leisure, and the backdoor buys time to wait for the right moment.

What does this change for Swarm operators?

The immediate operational question is key hygiene. Any operator who ran bee-js 13.3.0 or Swarm Desktop 0.56.2 should treat their current keys as compromised, regardless of whether funds have moved yet. The absence of confirmed losses is not evidence of safety — exfiltrated credentials can sit unused.

Watch for follow-up communications from Ethersphere on rotated release processes, and verify package versions before pulling dependencies. Until operators confirm clean versions and migrated wallets, exposure remains open on every node that touched the malicious builds.