ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT — Threadlinqs Intelligence
As of 2026-07-17, ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT is a high-severity supply chain threat attributed to SuccessKey, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1461 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: SuccessKey · FINANCIAL
Checkmarx Zero identified seven npm packages typosquatting the @vitejs/* namespace (ViteVenom), an expansion of the actor SuccessKey's earlier ChainVeil operation. The packages execute at import time
Between June 29 and July 3, 2026, threat actor SuccessKey published seven scoped npm packages typosquatting the popular @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui, together accruing more than 2,400 downloads before discovery by Checkmarx researcher Pavan Gudimalla. Checkmarx Zero published the finding on July 14, 2026 under the title 'Sequel to ChainVeil npm Malware Targets Vite Ecosystem,' naming the campaign ViteVenom and identifying it as a direct expansion of an earlier campaign, ChainVeil (disclosed by Checkmarx Zero on June 16, 2026), attributed to the same actor. Although ViteVenom's surface-level markers differ from ChainVeil's — different package names, npm maintainer accounts, Tier-1 wallet addresses, and malicious file paths, and scoped (@namespace/pkg) rather than unscoped package names for added false legitimacy — the underlying Tier-2 blockchain infrastructure is identical, allowing Checkmarx to cluster the two operations under one actor. Checkmarx's ChainVeil analysis additionally documents the loader's credential/wallet-theft targeting scope, which spans MetaMask, Phantom, TronLink, Trust Wallet, and exchange-linked (Binance, Coinbase, OKX) wallet extensions plus password managers and authenticator apps — consistent with the RAT's credential-harvesting capability observed in ViteVenom.
Unlike typical npm supply-chain malware that fires on `npm install` via lifecycle scripts, the ViteVenom payload is embedded in package code and executes at **import time**, i.e. only when a victim's application actually `require()`s or `import`s the compromised module. This delays and narrows detection: static install-time scanners and CI dependency-audit gates that only monitor postinstall hooks will miss it, and the malware only fires in developer/build/runtime contexts that actually load the code path.
The C2 design is a four-tier blockchain dead-drop chain that avoids any seizable domain or IP as the primary channel:
- **Tier 1 (per-package):** each of the seven packages resolves to its own dedicated Tron wallet address, giving the actor compartmentalized, disposable distribution — burning one package's Tier-1 wallet does not affect the others.
- **Tier 2 (shared, campaign-wide):** all seven packages converge on the same shared Tron wallet, the same Aptos account, and the same BSC transaction chain — this is the infrastructure fingerprint that links ViteVenom to ChainVeil.
- **Tier 3/4 (payload relay):** the loader queries the Tron blockchain (via the public TronGrid API, api.trongrid.io) for the attacker's latest transaction, decodes/reverses the transaction data field to derive a BSC transaction hash, queries that BSC transaction (via bsc-dataseed.binance.org / bsc-rpc.publicnode.com) for an encrypted payload carried in the transaction's input field, and decrypts it with a hard-coded key before executing it. If Tron resolution fails, the loader falls back to the Aptos account (fullnode.mainnet.aptoslabs.com) before continuing the same BSC relay step. Because dead-drop transaction data on a public blockchain is immutable and cannot be taken down by registrars, hosting providers, or law enforcement seizure the way a domain or IP can, the C2 channel is resistant to conventional infrastructure takedown.
- **Fallback:** if the entire blockchain resolution chain fails, the loader falls back to fetching the RAT payload directly from a traditional HTTP C2 server.
Once resolved and decrypted, the delivered payload is a full-featured Remote Access Trojan (RAT) providing the operator: an interactive reverse shell, harvesting of locally stored credentials (browser-stored, config files, environment secrets, and per ChainVeil's documented scope, cryptocurrency-wallet browser extensions and password managers), file-system exfiltration, and installation of a persistent backdoor. Checkmarx's remediation guidance specifically ca
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, cryptocurrency, financial-services
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1591, T1585, T1583, T1587, T1585, T1195, T1195, T1199, T1059, T1204