🚨 SlowMist TI Alert 🚨 A supply chain attack has compromised Ethersphere’s npm package `@ethersphere/[email protected]` and Swarm Desktop v0.56.2. Attackers abused compromised GitHub accounts and legitimate release pipelines to distribute malicious code across Windows, macOS, and Linux. The malicious code retrieves and executes remote JavaScript from `api[.]frameworkmetrics[.]xyz`. Its later-stage backdoor uses the Ethereum smart contract `0xf8a900Db50b3331be6B768bA460BB59f3E40C344` as a decentralized command-and-control (C2) configuration store, allowing attackers to dynamically update C2 addresses. The same contract was previously linked to the SleepyDuck / EtherDuck malware campaign targeting malicious Open VSX extensions. Potential risks include wallet credential theft, private key exfiltration, persistent backdoor deployment, and unauthorized remote access. Users should remove `@ethersphere/[email protected]`, pin version 13.2.0, and upgrade Swarm Desktop to the clean v0.56.3 release. Investigate affected systems, rotate potentially exposed credentials, and monitor suspicious connections to the malicious infrastructure. You can also visit https://www.misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! Reference: https://socket.dev/blog/bee-js-compromise https://enterprise.misteye.io/threat-intelligence/SM-2026-772730