ChainThink report, November 10: According to Socket monitoring, the Swarm development team Ethersphere has suffered a supply chain attack.

The attacker released a malicious version of bee-js 13.3.0 on npm on November 9, which was used to push an infected Swarm Desktop 0.56.2 via automatic updates.

The malicious code reads Bee node configuration files and encrypted wallet keystore data for exfiltration; due to plaintext storage of keystore passwords in configuration files, node wallets may be exposed, and devices could be compromised with remote control backdoors.

Currently, the affected versions have been removed from npm, and Ethersphere has withdrawn the corresponding desktop client version. No confirmed fund losses have been reported so far.