Blockchain security firm SlowMist has issued an urgent security warning for users within the Ethereum ecosystem, stemming from a sophisticated supply chain attack detected in Ethersphere software. The attack has compromised two distinct software versions, with hackers infiltrating the distribution channels.
Infiltration Expands Across Operating Systems
According to SlowMist, attackers exploited access to GitHub accounts, misusing legitimate software publishing processes to disseminate malicious versions. This threat has potential implications across multiple operating systems, including Windows, macOS, and Linux.
The compromised software forms part of Swarm, a decentralized storage network within the Ethereum ecosystem designed for data storage and content distribution. Consequently, the incident transcends a single application, posing risks to a wider audience of users and developers.
SlowMist revealed that hackers commandeered GitHub accounts to exploit legitimate version control processes, facilitating the spread of malicious software.
Malware Targets Sensitive Wallet Information
Security experts warn that these compromised versions could capture cryptocurrency wallet credentials, steal private keys, and establish persistent backdoors in affected systems, signaling a threat beyond typical malware incidents.
The firm explained that the malware downloads and executes hostile JavaScript codes. Furthermore, the assailants are utilizing an Ethereum smart contract as a decentralized command and control configuration repository, enabling updates to malicious server addresses without redistributions.
Connections to Previous Attacks Explored
The same Ethereum smart contract has been previously linked to known malware operations, SleepyDuck and EtherDuck, which targeted developers through malicious extensions in the Open VSX marketplace. This new event may represent a broader campaign directed at cryptocurrency developers and users.
Independent security researchers, including Socket and SafeDep, identified malicious components aimed at exfiltrating Swarm wallet files and establishing permanent remote access tools. These findings confirm that the attack poses a genuine risk of active data theft and system compromise.
SlowMist advises immediate removal of the affected package and a rollback to the secure version 13.2.0.
Call for Immediate Software Updates
SlowMist urges users to promptly uninstall the compromised package and revert to a secure version 13.2.0. Those utilizing Swarm Desktop v0.56.2 are advised to update to the clean version v0.56.3.
This alert underscores the essential practice of verifying reliable software versions among developers downloading software within the Ethereum ecosystem and wallet users. A thorough security audit of affected systems is recommended while technical details of the incident are scrutinized.
