ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT

ViteVenom Campaign (TL-2026-1461), also tracked as ViteVenom, is a high-severity supply-chain compromise, first published 2026-07-17 and last reviewed 2026-08-13. It is attributed to SuccessKey with medium confidence, affects npm (unofficial/typosquat package) @uw010010/vite-tree, maps to 32 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1461

Threat ID
TL-2026-1461
Also known as
ViteVenom, ChainVeil (predecessor campaign)
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-17
Last reviewed
2026-08-13
Attribution
SuccessKey
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, software-development, cryptocurrency, financial-services
Target regions
Global
Detection rules
9
Indicators of compromise
28
Updates
2026-08-13 · 2 updates

Malware and tooling in ViteVenom Campaign

Malware and tooling: ViteVenom RAT, jest-fet-mock, Ethereum smart contract 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b

Checkmarx Zero identified seven npm packages typosquatting the @vitejs/* namespace (ViteVenom), an expansion of the actor SuccessKey's earlier ChainVeil operation. The packages execute at import time and use a four-tier blockchain-based dead-drop C2 across Tron, Aptos, and Binance Smart Chain to deliver a RAT with reverse shell, credential harvesting, file exfiltration, and persistent backdoor capabilities.

How ViteVenom Campaign works

Between June 29 and July 3, 2026, threat actor SuccessKey published seven scoped npm packages typosquatting the popular @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui, together accruing more than 2,400 downloads before discovery by Checkmarx researcher Pavan Gudimalla. Checkmarx Zero published the finding on July 14, 2026 under the title 'Sequel to ChainVeil npm Malware Targets Vite Ecosystem,' naming the campaign ViteVenom and identifying it as a direct expansion of an earlier campaign, ChainVeil (disclosed by Checkmarx Zero on June 16, 2026), attributed to the same actor. Although ViteVenom's surface-level markers differ from ChainVeil's — different package names, npm maintainer accounts, Tier-1 wallet addresses, and malicious file paths, and scoped (@namespace/pkg) rather than unscoped package names for added false legitimacy — the underlying Tier-2 blockchain infrastructure is identical, allowing Checkmarx to cluster the two operations under one actor. Checkmarx's ChainVeil analysis additionally documents the loader's credential/wallet-theft targeting scope, which spans MetaMask, Phantom, TronLink, Trust Wallet, and exchange-linked (Binance, Coinbase, OKX) wallet extensions plus password managers and authenticator apps — consistent with the RAT's credential-harvesting capability observed in ViteVenom.

Unlike typical npm supply-chain malware that fires on `npm install` via lifecycle scripts, the ViteVenom payload is embedded in package code and executes at **import time**, i.e. only when a victim's application actually `require()`s or `import`s the compromised module. This delays and narrows detection: static install-time scanners and CI dependency-audit gates that only monitor postinstall hooks will miss it, and the malware only fires in developer/build/runtime contexts that actually load the code path.

The C2 design is a four-tier blockchain dead-drop chain that avoids any seizable domain or IP as the primary channel: - **Tier 1 (per-package):** each of the seven packages resolves to its own dedicated Tron wallet address, giving the actor compartmentalized, disposable distribution — burning one package's Tier-1 wallet does not affect the others. - **Tier 2 (shared, campaign-wide):** all seven packages converge on the same shared Tron wallet, the same Aptos account, and the same BSC transaction chain — this is the infrastructure fingerprint that links ViteVenom to ChainVeil. - **Tier 3/4 (payload relay):** the loader queries the Tron blockchain (via the public TronGrid API, api.trongrid.io) for the attacker's latest transaction, decodes/reverses the transaction data field to derive a BSC transaction hash, queries that BSC transaction (via bsc-dataseed.binance.org / bsc-rpc.publicnode.com) for an encrypted payload carried in the transaction's input field, and decrypts it with a hard-coded key before executing it. If Tron resolution fails, the loader falls back to the Aptos account (fullnode.mainnet.aptoslabs.com) before continuing the same BSC relay step. Because dead-drop transaction data on a public blockchain is immutable and cannot be taken down by registrars, hosting providers, or law enforcement seizure the way a domain or IP can, the C2 channel is resistant to conventional infrastructure takedown. - **Fallback:** if the entire blockchain resolution chain fails, the loader falls back to fetching the RAT payload directly from a traditional HTTP C2 server.

Once resolved and decrypted, the delivered payload is a full-featured Remote Access Trojan (RAT) providing the operator: an interactive reverse shell, harvesting of locally stored credentials (browser-stored, config files, environment secrets, and per ChainVeil's documented scope, cryptocurrency-wallet browser extensions and password managers), file-system exfiltration, and installation of a persistent backdoor. Checkmarx's remediation guidance specifically calls out inspecting shell profile files (.bashrc, .zshrc, .profile) for unauthorized modifications, indicating the backdoor establishes persistence via shell RC file injection in addition to any in-application persistence.

The blockchain dead-drop C2 pattern used by ViteVenom/ChainVeil is not unique tradecraft — it is part of a broader 2026 proliferation of blockchain-based dead-drop resolvers across independent npm supply-chain campaigns, indicating shared tradecraft innovation rather than shared operator identity: - The astro.config.mjs / PolinRider loader (analyzed by SafeDep, attributed to a DPRK-affiliated actor, reported July 1, 2026) uses a near-identical Tron→Aptos→BSC relay chain. - JFrog Security Research documented two hijacked npm packages, html-to-gutenberg (v4.2.11) and fetch-page-assets (v1.2.9), published May 25, 2026, that combined a VSCode-autorun-task execution trigger (rather than import-time or postinstall) with the identical Tron/Aptos/BSC dead-drop discovery mechanism (abusing the same api.trongrid.io / fullnode.mainnet.aptoslabs.com / bsc-dataseed.binance.org endpoints) to stage a Socket.io backdoor and a cross-platform Python infostealer targeting browsers, password managers, and cryptocurrency wallets; Nextron Research subsequently found the same malware embedded in 16 additional Go packages, indicating the technique and possibly the toolkit spans well beyond the npm ecosystem. This is a distinct, separately-attributed incident from ViteVenom/ChainVeil, cited here only as evidence the dead-drop design pattern is proliferating. - An earlier (2024) precedent, the jest-fet-mock npm package (typosquatting fetch-mock-jest / Jest-Fetch-Mock), used a single-chain Ethereum smart-contract `getString()` call as its C2 dead drop — establishing blockchain-dead-drop C2 as a recurring npm supply-chain technique that has since evolved into today's multi-chain (Tron/Aptos/BSC) designs.

No CVE has been assigned; this is a malicious-package supply-chain compromise, not a vulnerability in Vite or vitejs itself. The seven packages have since been reported for takedown; organizations should treat any of the seven package names found in a dependency tree as a confirmed compromise requiring full incident response (credential rotation, shell profile audit, host forensic review), not merely a package removal.

MITRE ATT&CK techniques used in TL-2026-1461

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1127 Trusted Developer Utilities Proxy Execution; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

Impact

T1499 Endpoint Denial of Service; T1657 Financial Theft

Persistence

T1505 Server Software Component; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1546 Event Triggered Execution

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Reconnaissance

T1591 Gather Victim Org Information

Affected products and versions in ViteVenom Campaign

  • npm (unofficial/typosquat package) — @uw010010/vite-tree
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vite-tab/tab
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vite-ln/build-ts
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vite-mcp/vite-type
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vite-pro/vite-ui
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vitets/vite-ts
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed
  • npm (unofficial/typosquat package) — @vite-ts/vite-ui
    Vulnerable versions: all versions published June 29-July 3, 2026
    Fixed in: package removed

Remediation for ViteVenom Campaign

Immediate actions

  • Remove @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui from all package.json/lockfiles immediately
  • Audit CI/CD build logs and developer workstations for evidence the packages were imported (not just installed) — import-time execution means install alone does not confirm compromise
  • Rotate all credentials accessible from any host or CI runner that resolved these packages (npm tokens, cloud provider keys, SSH keys, environment secrets, and any browser-extension cryptocurrency wallet seed phrases/keys)
  • Inspect .bashrc, .zshrc, .profile, and other shell RC files on affected hosts for unauthorized modifications
  • Hunt for outbound connections to Tron (api.trongrid.io), Aptos (fullnode.mainnet.aptoslabs.com), and BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) originating from build/CI infrastructure or developer endpoints, which are anomalous for typical Vite tooling
  • Check developer workstations for VSCode workspace `.vscode/tasks.json` autorun entries and unexpected font/asset files containing padded whitespace, given the same blockchain dead-drop pattern has been paired with VSCode-autorun triggers in related campaigns

Workarounds

  • Pin and vet all @vitejs/*-adjacent scoped package names manually before adoption; verify publisher/maintainer identity against the official vitejs GitHub org

Longer-term hardening

  • Enforce dependency allow-listing / private registry proxying for scoped packages resembling well-known namespaces (@vitejs/*)
  • Deploy runtime/import-time behavioral monitoring for Node.js processes, not just install-time (postinstall) script scanning
  • Implement egress filtering/allow-listing on build and CI infrastructure to block unexpected outbound calls to blockchain RPC/API endpoints
  • Adopt package-name similarity / typosquat detection tooling in CI dependency gates
  • Extend blockchain-RPC egress monitoring to Go module proxies and VSCode extension marketplaces, since the same dead-drop tradecraft has surfaced outside npm

Weaknesses (CWE) in ViteVenom Campaign

CWE-506, CWE-829, CWE-494, CWE-1357

Timeline of ViteVenom Campaign

  • Malicious cryptocurrency wallets tied to the SuccessKey actor's Tier-2 blockchain C2 infrastructure are activated, per Checkmarx Zero analysis, predating both the ChainVeil and ViteVenom package publications.
  • JFrog Security Research documents two hijacked npm packages (html-to-gutenberg v4.2.11, fetch-page-assets v1.2.9) that pair a VSCode-autorun-task execution trigger with an identical Tron/Aptos/BSC blockchain dead-drop discovery mechanism to stage a Socket.io backdoor and Python infostealer — a separately-attributed but tradecraft-overlapping incident, later found by Nextron Research to also affect 16 Go packages.
  • Checkmarx Zero publishes 'ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey,' the predecessor campaign that established the actor's typosquatting + blockchain-C2 tradecraft and documented its cryptocurrency-wallet and password-manager credential-theft targeting.
  • SuccessKey begins publishing the first of seven malicious npm packages typosquatting the @vitejs/* namespace to the public npm registry.
  • SafeDep publishes analysis of a contemporaneous, separately-attributed npm/astro.config.mjs supply-chain campaign (PolinRider, DPRK-linked) using a near-identical three-chain (Tron/Aptos/BSC) blockchain dead-drop C2 design, indicating the technique is proliferating across distinct threat actors.
  • Final of the seven ViteVenom packages is published to npm, closing the observed publication window with combined downloads exceeding 2,400.
  • Checkmarx Zero publishes the original ViteVenom research post, 'Sequel to ChainVeil npm Malware Targets Vite Ecosystem,' naming the campaign and formally clustering it with ChainVeil via shared Tier-2 blockchain infrastructure.
  • The Hacker News publishes coverage of the Checkmarx Zero findings, making the campaign public and prompting community remediation guidance.
  • Checkmarx researcher Pavan Gudimalla is credited with identifying and disclosing the seven-package ViteVenom campaign, clustering it with ChainVeil via shared Tier-2 blockchain infrastructure (same Tron wallet, Aptos account, BSC transaction chain).

Update history for TL-2026-1461

  • 2026-08-13 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 6 community-related indicator(s).
  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 12 community-related indicator(s).

Sources cited for ViteVenom Campaign

Threats related to ViteVenom Campaign

Detection coverage for TL-2026-1461

As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1461 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1461

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats