Blockchain security firm SlowMist has issued an urgent security alert for Ethereum users after detecting a complex supply chain attack that compromised two pieces of Ethersphere’s software used in the Swarm decentralized storage network.
According to SlowMist’s post on X, attackers broke into GitHub accounts and abused legitimate software release processes to push malicious releases. The compromised software could affect users across Windows, macOS and Linux and, the firm warned, the malicious releases may enable attackers to steal cryptocurrency wallet credentials, exfiltrate private keys and install permanent backdoors on affected systems.
How attackers used Ethereum infrastructure
SlowMist said the malware retrieves and executes malicious JavaScript code and leverages an Ethereum smart contract as a decentralized command-and-control (C2) configuration repository. Using the smart contract lets operators update server addresses that manage the malware dynamically, without redeploying the malicious software. SlowMist noted the same contract was previously linked to the SleepyDuck and EtherDuck campaigns, which targeted developers via malicious extensions on the Open VSX marketplace.
Independent security researchers at Socket and SafeDep also found malware focused on stealing Swarm wallet files and deploying persistent remote access tools. In response to the discovery, SlowMist advised users to immediately uninstall the affected package and roll back to the clean version 13.2.0. Users of Swarm Desktop v0.56.2 were told to update to the clean v0.56.3 release.
SlowMist’s alert frames the incident as a sophisticated supply chain compromise within the wider Ethereum ecosystem, with potentially broad impact for developers and users reliant on the affected Swarm software.
