SlowMist Warns of Ethersphere Supply Chain Attack Targeting Crypto Wallets
Blockchain security firm SlowMist has reported a supply chain attack targeting Ethersphere's Swarm ecosystem on November 9, 2026.
Attackers compromised the project's software release process and distributed malicious versions of two products: @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2.
The malware was designed to steal Swarm wallet private keys and passwords while installing remote-access backdoors on Windows, macOS, and Linux devices.
Both compromised releases have been withdrawn. However, users who installed them should consider their devices compromised, as removing the software alone may not eliminate the malware.
Users are advised to move affected funds to a newly generated wallet using a clean device and rotate potentially exposed credentials.
The incident highlights the growing risks of software supply chain attacks, where hackers exploit trusted development and distribution systems to target cryptocurrency users.
Sources:
SlowMist: https://x.com/SlowMist_Team/status/2120045378792010166
Socket: https://www.socket.dev/blog/bee-js-compromise
The Hacker News: https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
SafeDep: https://safedep.io/blog/ethersphere-bee-js-npm-compromise