Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.
Intelligence analysis by Llama
The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an unprecedented four-tier blockchain-based command-and-control (C2) infrastructure to deliver a remote access trojan (RAT).
Imagine you're a developer building a website using a tool called Vite. A bad guy has created fake packages that look like they're part of Vite, but actually contain malware. When you install these fake packages, the malware can take control of your computer and steal your information. This is like a Trojan horse, where the bad guy is hiding inside a package that looks harmless.
Analysis
A $60B Vote of Confidence
The discovery of seven malicious npm packages targeting the Vite frontend tooling ecosystem marks a significant expansion of ChainVeil, a software supply chain attack that was first observed in February 2026. The malicious package campaign, codenamed ViteVenom by Checkmarx, uses a four-tier blockchain-based command-and-control (C2) infrastructure to deliver a remote access trojan (RAT) capable of reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection.
The activity has been attributed to a threat actor named SuccessKey, with evidence of malicious activity detected as far back as February 27, 2026, when cryptocurrency wallets linked to ViteVenom were activated. While the typosquats published to npm in connection with ChainVeil masqueraded as libraries for Tailwind, Sass, ORM, and rate-limiting tools, the latest iteration specifically focuses on developers building applications using the Vite JavaScript and frontend build tool.
The list of identified packages, published between June 29 and July 3, 2026, is below:
- @uw010010/vite-tree (1070 Downloads)
- @vite-tab/tab (289 Downloads)
- @vite-ln/build-ts (252 Downloads)
- @vite-mcp/vite-type (239 Downloads)
- @vite-pro/vite-ui (200 Downloads)
- @vitets/vite-ts (194 Downloads)
- @vite-ts/vite-ui (176 Downloads)
Another crucial difference between the two clusters is that, unlike ChainVeil's unscoped typosquats (e.g., "rate-limit-flexible"), ViteVenom makes use of scoped package names in an attempt to impersonate the "@vitejs/*" namespace and lend it a veneer of legitimacy.
The main aspect that unites the two campaigns is the use of shared tier-2 infrastructure, which is used to deliver the RAT. Specifically, this involves the same Tron wallet and Aptos account addresses, which point to the same Binance Smart Chain (BSC) transaction leading to the malware.
Like in the case of ChainVeil, the malicious code doesn't execute at install time but at import time, which has the consequence of limiting endpoint security detections. It acts as a loader by reaching out to the blockchain infrastructure to obtain the next-stage - Query the Tron blockchain for the latest transaction from the attacker's wallet. Decode and reverse the transaction data field to obtain a BSC transaction hash. Query the BSC transaction to extract the encrypted payload from its input field. Decrypt the payload using a hard-coded key.
The attacker stores payload pointers as transaction data on public blockchains rather than on domain names that can be seized, making the infrastructure nearly impossible to take down," Gudimalla explained.
If the Tron-based payload retrieval method fails, the malware uses Aptos as a backup. The payload, for its part, queries the blockchain to retrieve the C2 configuration and a next-stage loader responsible for launching the RAT. In tandem, there exists a fallback mechanism that fetches the RAT directly from the C2 server over HTTP, completely bypassing the blockchain.
Users who have installed the packages are advised to remove them immediately, audit dependencies, rotate all credentials, and look for unauthorized modifications to .bashrc, .zshrc, and .profile files.
The surface-level differences - different package names, different maintainer accounts, different Tier-1 wallets, different malicious file paths - are consistent with how a single operator would compartmentalize multiple distribution tracks to limit exposure," Checkmarx said.
Key points
- Seven malicious npm packages targeting the Vite frontend tooling ecosystem have been discovered.
- The malicious package campaign, codenamed ViteVenom by Checkmarx, uses a four-tier blockchain-based command-and-control (C2) infrastructure to deliver a remote access trojan (RAT).
- The activity has been attributed to a threat actor named SuccessKey, with evidence of malicious activity detected as far back as February 27, 2026.
- Users who have installed the packages are advised to remove them immediately, audit dependencies, rotate all credentials, and look for unauthorized modifications to .bashrc, .zshrc, and .profile files.
If developers and users are aware of this attack and take steps to remove the malicious packages, rotate credentials, and audit dependencies, the impact of this attack can be minimized. Additionally, if the Vite community and npm take steps to improve their security measures, such as implementing better package validation and authentication, the likelihood of similar attacks in the future can be reduced.
The use of blockchain-based C2 infrastructure makes it difficult to take down the malware, and the fact that the malicious code executes at import time limits endpoint security detections. Additionally, the use of scoped package names and the impersonation of the "@vitejs/*" namespace can make it difficult for users to identify the malicious packages.
