[Swarm Decentralized Storage Project Development Kit and Desktop Client Poisoned, Potentially Stealing Node Wallets] According to an analysis report released by security firm Socket, Ethersphere, the development team behind the decentralized storage project Swarm, suffered a supply chain attack. On November 9th, attackers released a malicious version of bee-js 13.3.0 to npm and automatically pushed a malware-infected Swarm Desktop 0.56.2. The malicious code reads the Bee node's configuration file and encrypted wallet keystore and sends it back to the attackers. Because the keystore password is stored in plaintext in the configuration file, the node wallet may be exposed. It also implants a remote control backdoor on the device. npm has since removed this version, and Ethersphere has also withdrawn the relevant desktop client version. No confirmed financial losses have been reported so far.