Security firm Socket identified a supply chain attack targeting Ethersphere, the development team behind decentralized storage project Swarm. On November 9, an attacker published a malicious version of the bee-js package (13.3.0) to npm and distributed a trojanized Swarm Desktop application (version 0.56.2) via automatic updates. The injected malware reads the Bee node's configuration file and encrypted wallet keystore, transmitting them to the attacker. Because the keystore password is stored in plaintext within the configuration file, node wallets are exposed to theft. The payload also implants a remote-control backdoor on affected devices. npm has removed the malicious package version, and Ethersphere has withdrawn the compromised desktop release. No fund losses have been confirmed. Socket advises users who installed the affected versions to uninstall them immediately, generate new keys on a clean device, and migrate wallet funds and staking positions.