SlowMist issued an urgent alert after detecting a sophisticated supply-chain attack against two pieces of software from Swarm, the decentralized storage network within the Ethereum ecosystem. Hackers compromised GitHub accounts and abused legitimate release processes to distribute malicious versions that could affect Windows, macOS, and Linux. The malware executes JavaScript and uses an Ethereum smart contract as a decentralized command-and-control configuration repository, allowing it to change its server addresses dynamically without a new deployment. The same contract had previously been linked to the SleepyDuck and EtherDuck malware campaigns, which targeted developers through malicious Open VSX marketplace extensions. Researchers from Socket and SafeDep also found tools designed to steal Swarm wallet files and establish persistent remote access. SlowMist advises users to immediately uninstall the compromised packages, roll back to the clean version 13.2.0, and, for Swarm Desktop v0.56.2, update to the clean v0.56.3 release.
Source: Read the original article
