A node wallet stays private only if the software and files that can unlock it stay private. For people running a Swarm Bee node, a report published in November 2026 describes an update that may have copied both an encrypted wallet keystore and the password stored beside it.
Odaily Planet Daily published that account at 02:57 (UTC+8) on November 10, 2026, citing monitoring by Socket. The report said Ethersphere, the development team behind the decentralized storage project Swarm, had suffered a supply-chain attack. It said that on November 9 an attacker published malicious bee-js 13.3.0 to npm, and that an automatic update pushed a trojanized Swarm Desktop 0.56.2.
As described in that report, the malicious code reads Bee node configuration files and encrypted wallet keystores and sends them back to the attacker. The configuration file stores the keystore password in plaintext, so the node wallet may be exposed even though the keystore itself is encrypted. The same code was also said to plant a remote-control backdoor on the device.
The plaintext password is an accessibility choice: the node can open the wallet without asking for the secret again. It undercuts confidentiality, because the password that protects the keystore sits in the configuration the malware was described as reading. Extra copies of that same configuration would repeat the password; they would not create a safer recovery path. Nothing in the report suggests that local encryption, or a later removal of the bad release, undoes a copy already sent off the machine or a backdoor already installed.
By the time of the Odaily report, npm had taken down bee-js 13.3.0 and Ethersphere had withdrawn the related desktop version. Odaily said there were no confirmed fund losses. That is an absence of confirmed losses in the report, not a count of wallets read or assets moved. The report does not say how many nodes installed the releases.
The only version check the report itself supports is whether a node had bee-js 13.3.0 or Swarm Desktop 0.56.2. It does not describe cleanup steps. On this account, a machine that ran either release may have had its configuration and keystore sent to the attacker and a backdoor implanted, whether or not any loss had been confirmed.
Original report: Odaily Planet Daily, published November 10, 2026, 02:57 (UTC+8).
