ethereum swarm, a decentralized storage network, got hit with a supply chain attack today. hackers took over its release process and pushed two poisoned updates: - bee-js 13.3.0, a code library developers install from npm - swarm desktop 0.56.2, the app people run at home install either one and it steals your node's wallet key and drops a hidden backdoor on windows, mac or linux. swarm confirmed it and pulled both versions. who's at risk: anyone who updated swarm desktop today, and developers whose projects pulled in bee-js 13.3.0. tools like swarm-cli and bee-dashboard could have grabbed it automatically, so you might be affected without knowing. what to do: - move your funds and stake to a fresh wallet now - reinstall swarm desktop 0.56.1 - developers, pin bee-js at 13.2.0 - updating alone won't remove the backdoor. treat that machine as compromised and follow swarm's cleanup steps still unknown: how many machines got hit, or if anything was actually stolen. nobody broke the network itself. they poisoned the update. that's the weak spot now, and auto-updates make it worse. @ethswarm