Trojanized Swarm Releases Put Bee Node Wallet Credentials at Risk

Swarm users face a wallet security threat after malicious releases of the Bee JavaScript package and Swarm Desktop were designed to steal node credentials and install a remote-control backdoor.

Security firm Socket identified a compromised bee-js 13.3.0 package uploaded to npm on Monday, Nov. 9, alongside Swarm Desktop 0.56.2, which reached users through automatic updates. Socket found that the code read Bee node configuration files and encrypted wallet keystores, then sent that data to attackers.

The configuration files stored the keystore password in plain text, which could let attackers unlock the encrypted wallet file and put node wallets at risk. The desktop malware also installed a remote-control backdoor on affected devices. No financial losses have been confirmed.

The malicious npm release has been removed, and Ethersphere withdrew the affected desktop version. Affected users should uninstall compromised releases, generate new keys on a clean device, and transfer wallet funds and staked assets.

Swarm is a decentralized storage project, and Bee is its node software.