The decentralized storage project Swarm's software was implanted with malicious code that steals wallet data.

Swarm's Ethersphere release pipeline was compromised, injecting malicious code into npm package @ethersphere/bee-js 13.3.0 and the Swarm Desktop 0.56.2 app, according to security research team Socket. The loader downloads and executes remote code, with a follow-on payload reading Swarm Desktop's config files and node wallet keys. The affected desktop build shipped through the project's own build process and reached some users via auto-update, though npm has since removed the impacted package version. The incident matters because Bee nodes hold wallet keys tied to Swarm's storage incentive layer, so a compromised desktop client could expose funds rather than just data. Watch for Ethersphere's post-mortem and a patched release, plus confirmation of how many users received 0.56.2 through auto-update.