SlowMist issued an urgent security alert on Tuesday after discovering a supply chain attack targeting Ethereum ecosystem software through compromised GitHub accounts. Attackers hijacked developer accounts and pushed malware through legitimate release processes for Swarm, a decentralized storage network, affecting Windows, macOS and Linux users. The malware retrieves and executes malicious JavaScript code designed to steal private keys and cryptocurrency wallet credentials. An Ethereum smart contract serves as a decentralized command-and-control repository, allowing attackers to rotate malware server addresses without deploying fresh malicious builds to infected systems.
Attackers Hijacked GitHub Accounts and Pushed Malware Through Official Release Channels
The supply chain attack on the Swarm storage project reached Ethereum users through official software update channels. SlowMist, a blockchain security firm, raised the alert after finding that attackers had broken into GitHub accounts and used the legitimate release process to publish malicious builds. Two pieces of software were compromised through this method. The affected code belongs to Swarm, a decentralized storage network inside the wider Ethereum ecosystem, and runs on Windows, macOS and Linux. Once installed on a machine, the malware retrieves and executes JavaScript code pulled from attacker-controlled infrastructure. The malicious releases can compromise cryptocurrency wallet credentials, steal private keys and open permanent backdoors on affected systems. The warning concerns Ethereum's tooling rather than the Ethereum price itself, and the disclosure does not claim that on-chain funds have already been drained. The delivery path involved a developer account takeover at the source, a malicious build pushed through normal release channels, and users across three operating systems left to determine whether their installed copy was clean. Swarm functions as storage infrastructure for the ecosystem. SlowMist published the full breakdown on X, laying out both the delivery path and the cleanup steps.
Ethereum Smart Contract Functions as Decentralized Command-and-Control Infrastructure
The mechanism behind the attack extends beyond a one-off trojan. In its alert posted on X, SlowMist explains that the operators rely on an Ethereum smart contract as a decentralized command-and-control configuration repository. Because the configuration sits in the contract, the attackers can swap the server addresses that manage the malware without shipping a fresh malicious build to already-infected machines. Taking down any single server does not break the campaign. SlowMist adds that the same contract was previously associated with the SleepyDuck and EtherDuck malware operations, campaigns that targeted developers through malicious extensions distributed on the Open VSX marketplace. That reuse points to the possibility that the Swarm incident is one part of a broader operation aimed at compromising cryptocurrency developers and users. Independent security researchers at Socket and SafeDep, working separately from SlowMist, found malware built to steal Swarm wallet files and to deploy persistent remote-access tools on infected systems. Their findings line up with the alert on the persistence question: the tools were built to stay on the machine, not to run once and vanish. The alert does not say how long the compromised builds sat in the release channel before anyone flagged them, or how many machines downloaded them in that window.
SlowMist Advises Users to Uninstall Affected Packages and Roll Back to Clean Versions
SlowMist advises users to uninstall the affected package immediately and roll back to the clean version 13.2.0. Anyone running Swarm Desktop v0.56.2 should update to the clean v0.56.3 release. Anchoring the malware's configuration in a smart contract on Ethereum gives the operators infrastructure rotation that survives server takedowns. The point in the sequence that can still be interrupted sits on the user's machine: uninstalling the package and rolling back to version 13.2.0, or upgrading Swarm Desktop to v0.56.3, cuts the installed payload off before it does further damage. The alert names no victim count, and none has been published.
FAQ
What did SlowMist discover on Tuesday regarding Ethereum ecosystem software?
SlowMist issued an urgent security alert on Tuesday after discovering a supply chain attack targeting Ethereum ecosystem software through compromised GitHub accounts. Attackers hijacked developer accounts and pushed malware through legitimate release processes for Swarm, affecting Windows, macOS and Linux users.
How does the malware's command-and-control infrastructure function?
The operators rely on an Ethereum smart contract as a decentralized command-and-control configuration repository. Because the configuration sits in the contract, attackers can swap the server addresses that manage the malware without shipping fresh malicious builds to already-infected machines, making server takedowns ineffective.
What remediation steps does SlowMist recommend for affected users?
SlowMist advises users to uninstall the affected package immediately and roll back to the clean version 13.2.0. Anyone running Swarm Desktop v0.56.2 should update to the clean v0.56.3 release to cut off the installed payload before it causes further damage.
