SlowMist Warns Ethereum (ETH) Users of Swarm Supply Chain Attack via GitHub

Malware Rides the Official Release Channel

A supply chain attack on the Swarm storage project reached Ethereum (ETH) users through the channel they are trained to trust: the official software update. SlowMist, a blockchain security firm, raised an urgent alert on Tuesday after finding that attackers had broken into GitHub accounts and used the legitimate release process to publish malicious builds, so victims installed the malware as if it were a routine Swarm download. Two pieces of software were compromised this way. The affected code belongs to Swarm, a decentralized storage network inside the wider Ethereum ecosystem, and it runs on Windows, macOS and Linux alike. Once on a machine, the malware retrieves and executes JavaScript code pulled from attacker-controlled infrastructure, which turns a poisoned installer into a live infection rather than a dormant file. The stakes that follow are concrete: these malicious releases can compromise cryptocurrency wallet credentials, steal private keys and open permanent backdoors on affected systems. The warning concerns Ethereum's tooling rather than the Ethereum price itself, and nothing in the alert claims that on-chain funds have already been drained. What the disclosure does establish is the delivery path: a developer account takeover at the source, a malicious build pushed through normal release channels, and users across three operating systems left to determine after the fact whether their installed copy was clean. Swarm functions as storage infrastructure for the ecosystem, so the audience for the warning is broad: anyone who downloaded the affected releases on any of the three platforms. SlowMist published the full breakdown on X, laying out both the delivery path and the cleanup steps.

Smart Contract Serves as Command Server

The mechanism behind the attack goes beyond a one-off trojan. In its alert posted on X, SlowMist explains that the operators rely on an Ethereum (ETH) smart contract as a decentralized command-and-control configuration repository, an instruction store that lives on-chain. Because the configuration sits in the contract, the attackers can swap the server addresses that manage the malware whenever they need to, without shipping a fresh malicious build to already-infected machines; taking down any single server therefore does not break the campaign. SlowMist adds that the same contract was previously associated with the SleepyDuck and EtherDuck malware operations, campaigns that targeted developers through malicious extensions distributed on the Open VSX marketplace. That reuse points to the possibility that the Swarm incident is one part of a broader operation aimed at compromising cryptocurrency developers and users, rather than an isolated event with a single motive. Independent security researchers at Socket and SafeDep, working separately from SlowMist, found malware built to steal Swarm wallet files and to deploy persistent remote-access tools on infected systems. Their findings line up with the alert on the persistence question: the tools were built to stay on the machine, not to run once and vanish. The remediation steps are specific. SlowMist advises users to uninstall the affected package immediately and roll back to the clean version 13.2.0, while anyone running Swarm Desktop v0.56.2 should update to the clean v0.56.3 release. What the alert does not say is how long the compromised builds sat in the release channel before anyone flagged them, or how many machines downloaded them in that window; those figures were not disclosed at publication.

The One Point Still in Users’ Hands

What stands out in the disclosure is the command layer, not the payload. Anchoring the malware's configuration in a smart contract on Ethereum (ETH), the layer-1 network the contract runs on, gives the operators infrastructure rotation that survives server takedowns, so pressure aimed at hosting providers buys little. The point in the sequence that can still be interrupted sits on the user's machine: uninstalling the package and rolling back to version 13.2.0, or upgrading Swarm Desktop to v0.56.3, cuts the installed payload off before it does further damage. For anyone running Ethereum-ecosystem software, from a desktop client to a blockchain node, the update channel itself is the surface to watch. Readers weighing whether to run an Ethereum node at home face the same class of risk. The alert names no victim count, and none has been published.