Swarm Software Attack Puts Wallet Keys at Risk Across Major Systems

SlowMist and Socket identified malicious code in two releases of Ethersphere's Swarm software that can steal wallet keys and credentials and retrieve command-server addresses through Ethereum.

The affected packages were the JavaScript library @ethersphere/bee-js version 13.3.0 and Swarm Desktop version 0.56.2. The releases affect Windows, macOS and Linux systems. SlowMist and Socket traced the tampering to a compromised GitHub account and a hijacked official release process, which put malicious code inside packages distributed under Swarm's name.

The malware retrieves command-and-control (C2) server addresses dynamically from an Ethereum smart contract. That lets its operators change which servers infected devices contact. The same infrastructure had previously been used in SleepyDuck and EtherDuck malware activity.

GitHub's security advisory warned that devices with either affected version installed should be treated as compromised. The macOS installer also retained Apple's code signature and notarization despite containing malicious code.