According to CoinMeta, as disclosed by the security research team of socket, on November 9th, attackers exploited compromised GitHub accounts and the automated release processes of Ethersphere to release malicious versions of bee-js (13.3.0) and Swarm Desktop (0.56.2) that contained malware. The malware was capable of stealing wallet keys and passwords from Swarm nodes and deploying remote control backdoors on users' devices. Research found that this attack utilized the same Ethereum smart contracts and backdoor components as previous attacks on Sleepyduck and Etherduck. Control over the servers was obtained through these smart contracts on the blockchain. Both malicious versions were removed approximately 75 minutes and 8.5 hours after they were released, respectively, and the exact number of users affected is still unclear.