Blockchain security organization SlowMist has released an urgent security notice regarding a sophisticated supply chain attack impacting software within the Ethereum ecosystem. According to the firm, hackers managed to breach GitHub accounts and abuse legitimate release processes to distribute malicious software across multiple operating systems, including Windows, macOS, and Linux.
The compromised software is tied to Swarm, a decentralized storage network. Security specialists report that the malicious payloads are designed to steal crypto wallet credentials, extract private keys, and install persistent backdoors. The malware fetches and executes JavaScript code by utilizing an Ethereum smart contract as a decentralized command-and-control configuration repository, allowing attackers to dynamically alter server addresses. Researchers noted that the smart contract was previously linked to earlier malware campaigns like SleepyDuck and EtherDuck.
Additional independent researchers from Socket and SafeDep also identified malware intended to steal Swarm wallet files and establish remote access tools. SlowMist has urged users to remove the affected packages immediately and downgrade to clean version 13.2.0, or update Swarm Desktop v0.56.2 to the safe v0.56.3 release.
For crypto readers and market participants, this incident highlights ongoing supply chain vulnerabilities targeting decentralized networks and developer tools, posing direct security risks to user funds and operational infrastructure.