Understand Ethereum security alerts: a blockchain supply chain attack affecting Swarm wallets and the role of smart contract malware.
The official software distribution channel introduced malware designed to steal wallets into the Swarm ecosystem, prompting SlowMist to issue a severe Ethereum security alert on November 10, 2026. This supply chain attack affected the bee-js package and Swarm Desktop application; users were urged to remove the compromised software, install clean versions, and replace exposed wallet keys.
Key points
- The compromised versions are bee-js 13.3.0 and Swarm Desktop 0.56.2.
- An Ethereum smart contract helped the attacker manage malware infrastructure.
- The cleanup measures include not only software updates but also the removal of backdoors and the replacement of wallet keys.
Ethereum security alert originates from a compromised release version
The automated release process of Ethersphere was compromised on November 9, 2026, and malware was distributed through official channels. The affected products belong to Swarm, a decentralized storage network within the Ethereum ecosystem.
A malicious @ethersphere/bee-js 13.3.0 npm package appeared at approximately 00:09 UTC, followed by Swarm Desktop 0.56.2 at approximately 00:36 UTC, about 27 minutes later.
SlowMist stated that the attacker compromised the GitHub account and abused the legitimate release process. This breach of the release workflow involved the bee-worker bot or compromised continuous integration credentials.
The tampered package contains a postinstall hook: these scripts automatically execute during installation without requiring further user interaction. The associated scripts contact servers controlled by the attackers to download additional payloads.
Smart contract management of malware infrastructure
SlowMist stated that the attackers used an Ethereum smart contract as a decentralized command-and-control configuration repository, allowing them to change the server addresses managing the malware without needing to republish the malware version.
Malware retrieves and executes malicious JavaScript. This contract was previously associated with SleepyDuck and EtherDuck, malicious activities that targeted developers through malicious extensions on the Open VSX marketplace.
Researchers have discovered wallet theft and persistent access
Researchers from Socket and SafeDep independently discovered that this malware is designed to steal Swarm wallet files and install a persistent remote access tool. The malicious release could expose wallet credentials and private keys while leaving a permanent backdoor on affected systems.
The research findings indicate that the goal is to empty xDAI and xBZZ tokens, chequebook funds, and staked assets associated with Swarm nodes.
Clean the version and replace the wallet key.
In its Ethereum security advisory, SlowMist urges affected users to immediately remove the compromised package and revert to bee-js 13.2.0. For users running Swarm Desktop v0.56.2, it is recommended to switch to the unaffected v0.56.3 version.
According to the GitHub security advisory GHSA-hh7j-5m3j-23pf, any system that installed the compromised package should be considered "fully compromised." Ethereum Swarm also alerted users via Discord to lock their systems and replace the affected desktop versions.
Affected users are advised to remove the backdoor and completely replace their wallet keys. Simply updating the software will not protect assets associated with keys already compromised by attackers, nor will it eliminate persistent mechanisms implanted on the device.
Also read: Bhutan’s Ethereum-based digital identity can verify credentials without on-chain data storage · Ondo brings over 100 U.S. securities to Ethereum: 24/7 access with on-chain pricing
This article was generated with the assistance of artificial intelligence and reviewed by the editorial team.