Malicious code stealing wallet data embedded in software of decentralized storage project Swarm

TechFlow news, November 10, according to a report by security research team Socket, attackers exploited Ethersphere's release process to embed malicious code in npm package @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 desktop application.

Socket analysis said the malicious loader downloads and executes remote code, and subsequent payloads read Swarm Desktop configuration files and node wallet keys. The affected desktop version was released through the project's own build process and was provided to some users via automatic updates. npm has removed the affected package versions.

Source: TechFlow