A sophisticated software supply chain attack has struck Ethereum Swarm, compromising official developer packages and desktop software to plant wallet-stealing malware on user computers. Attackers hijacked developer credentials and release automation for the decentralized storage project, deploying poisoned updates through Swarm Desktop version 0.56.2 and the developer library bee-js version 13.3.0. For everyday crypto investors and node operators, this intrusion bypassed traditional smart contract security entirely, turning an authorized software update into a silent digital burglar designed to siphon private keys and unlock passwords straight from host hard drives.
By Elena Kowalski | November 10, 2026
What Happened
On November 9, 2026, cybersecurity researchers and blockchain security teams detected a malicious intrusion into the official distribution channels of Ethereum Swarm, a decentralized storage network developed by Ethersphere. In the crypto ecosystem, Swarm acts like a cooperative digital warehouse where independent computer operators—known as node runners—rent out hard drive space to store blockchain data and earn network tokens in return.
Instead of launching an expensive on-chain exploit against smart contracts or attempting to crack cryptographic math, the attackers took an easier and far more dangerous route: they compromised the release pipeline that delivers software to user desktops. By seizing control of project maintainer accounts and automated publishing workflows, the hackers pushed out poisoned software updates under the project’s legitimate name.
Blockchain security firm SlowMist and supply-chain intelligence group Socket identified that the compromised packages contained hidden scripts engineered to hunt down crypto wallet files, extract stored passwords, and establish permanent remote backdoors. Because the malicious code arrived through official distribution channels, automated security filters initially treated the downloads as trusted software.
- Compromised Desktop App — Swarm Desktop version 0.56.2, pushed out through automatic updates and direct downloads.
- Compromised Developer Library — @ethersphere/bee-js version 13.3.0, published directly to the public npm package registry.
- Attack Objective — Silent extraction of Bee node private keys, configuration files, and system passwords.
- Current Remedy — Immediate rollback to bee-js version 13.2.0 and clean upgrade to Swarm Desktop version 0.56.3.
How the Attack Worked
To understand how this attack unfolded, think of software supply chain tampering like a criminal intercepting a sealed package inside a delivery warehouse. The delivery truck belongs to a trusted brand and the shipping label is completely authentic, but someone swapped the legitimate contents for a surveillance device before the box reached your front door.
In the developer library @ethersphere/bee-js version 13.3.0, attackers weaponized an internal file named generate-version.cjs. They modified the project configuration so that this script would execute as an automatic installation hook. In simple terms, the moment a developer or automated system downloaded the package, the computer immediately ran the attacker’s script in the background with full administrative privileges, without asking for confirmation.
Once triggered, the malicious script reached out across the internet to an external server hosted at api.frameworkmetrics.xyz to pull down secondary commands. Security analysts noted that this server infrastructure shared distinct operational signatures with previous intrusions tracked under the moniker SleepyDuck, an intrusion cluster known for targeting crypto development environments.
I checked the package registry history and verified the publication timestamp: the malicious package went live on November 9 before maintainers revoked the release credentials.
On local machines, the rogue software searched standard directories for sensitive configuration files, specifically hunting for config.yaml and swarm.key. These files contain the encrypted cryptographic keys that unlock a node’s wallet. More critically, the script scraped configuration text to capture plaintext passwords that operators frequently save to let their nodes restart automatically. Meanwhile, Swarm Desktop version 0.56.2 went a step further, dropping persistent remote-access software across Windows, macOS, and Linux operating systems to give the attackers ongoing access even after the primary software closed.
Who Is Affected
The primary victims of this campaign are participants who downloaded or updated Swarm Desktop between the release of version 0.56.2 and its official withdrawal, as well as decentralized application developers whose build pipelines pulled bee-js version 13.3.0 on November 9.
For everyday investors, the danger lies in how desktop node software interacts with personal finances. Running a storage node requires funding an active blockchain wallet with assets like Ethereum—currently trading around 2,043 USD—to cover operational transaction fees and post network collateral. Many retail operators install desktop node clients on the same personal computers where they browse the web, store software wallets, or keep backup recovery files.
If an attacker gains remote administrative control over your machine, they do not just possess your Swarm node keys; they can watch keystrokes, view clipboard copies, and search local folders for private keys belonging to other wallets. With the broader Crypto Fear & Greed Index registering 32 in the Fear bracket, this breach reinforces investor anxieties about operational security beyond standard smart contract audits.
What the Team Is Doing
The Ethersphere core team and registry maintainers moved quickly to sever the attackers’ distribution channel once external analysts raised the alarm. The compromised bee-js version 13.3.0 was promptly delisted and pulled down from the public npm registry to halt further automated downloads across developer environments.
To repair the desktop application pipeline, the team deployed Swarm Desktop version 0.56.3. This release completely discarded the tainted codebase, reverting the application to the known clean baseline of version 0.56.1 while signing the executable with a freshly issued developer certificate. Project maintainers also revoked the compromised credentials and release bot tokens that the attackers abused to inject the rogue code into the project’s distribution pipeline.
Security trackers at SlowMist and Socket confirmed that rapid coordination helped prevent widespread capital drainage across the network. However, both firms stressed that pushing a clean software update solves only half the problem, because any computer that executed the malicious update may still harbor persistent backdoors left behind by the initial script.
How to Protect Yourself
If you run a Swarm node or installed Swarm Desktop recently, you must take active defensive measures immediately. Treating this incident like a routine software bug could leave your digital assets exposed to future theft.
- Evacuate Node Funds Immediately — Transfer all crypto tokens, staking collateral, and operational funds out of the wallet connected to your Swarm node. Send these assets to a fresh wallet address generated on a separate, uncompromised hardware device.
- Do Not Rely on a Simple Update — Merely upgrading to Swarm Desktop version 0.56.3 will not delete backdoors that were already planted on your system. If your device ran version 0.56.2, treat the entire operating system as compromised.
- Perform a Full System Wipe — Back up only essential non-executable personal documents, disconnect the machine from your home network, and perform a complete reinstallation of your operating system.
- Rotate All Passwords and Secrets — Change master passwords for password managers, email accounts, and exchange profiles from a clean phone or secondary computer, especially if you ever unlocked them on the infected device.
- Purge Developer Caches — Developers who manage Node.js environments must clear their global package caches, delete existing lockfiles, and explicitly pin dependencies to bee-js version 13.2.0 or verified clean patches.
Elena Kowalski’s take
Automating software releases without human approval gates turns trusted developer tools into distribution pipelines for wallet drainers. The critical detail I am looking for is whether node operators migrating to Swarm Desktop 0.56.3 drain their node balances to uncompromised hardware wallets before backdoors harvest their keys. Should secondary malicious commits surface across related Ethereum client repositories this week, the assumption that this intrusion stopped at Ethersphere’s build pipeline will prove dangerously mistaken.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
swarm desktop 0.56.2 auto-updating straight onto node machines is the nightmare scenario. if your keys live on the same disk as that install you should assume theyre gone, not check later
^ exactly. everyone preaches verify signatures but these were the projects own signatures. only real defense is keys on hardware, never on the host running swarm
The part that gets me is they hijacked the release automation itself. Official signed packages mean none of the usual checksum advice helps here.
agree on urgency but bee-js 13.3.0 came through npm, thats devs who pinned versions and got burned anyway. rough week to trust any dependency