# ViteVenom Campaign: Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT

> Checkmarx Zero identified seven npm packages typosquatting the @vitejs/* namespace (ViteVenom), an expansion of the actor SuccessKey's earlier ChainVeil operation. The packages execute at import time and use a four-tier blockchain-based dead-drop C2 across Tron, Aptos, and Binance Smart Chain to deliver a RAT with reverse shell, credential harvesting, file exfiltration, and persistent backdoor capabilities.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-08-13T10:33:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1461
- **ID:** TL-2026-1461
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** SuccessKey
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between June 29 and July 3, 2026, threat actor SuccessKey published seven scoped npm packages typosquatting the popular @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui, together accruing more than 2,400 downloads before discovery by Checkmarx researcher Pavan Gudimalla. Checkmarx Zero published the finding on July 14, 2026 under the title 'Sequel to ChainVeil npm Malware Targets Vite Ecosystem,' naming the campaign ViteVenom and identifying it as a direct expansion of an earlier campaign, ChainVeil (disclosed by Checkmarx Zero on June 16, 2026), attributed to the same actor. Although ViteVenom's surface-level markers differ from ChainVeil's — different package names, npm maintainer accounts, Tier-1 wallet addresses, and malicious file paths, and scoped (@namespace/pkg) rather than unscoped package names for added false legitimacy — the underlying Tier-2 blockchain infrastructure is identical, allowing Checkmarx to cluster the two operations under one actor. Checkmarx's ChainVeil analysis additionally documents the loader's credential/wallet-theft targeting scope, which spans MetaMask, Phantom, TronLink, Trust Wallet, and exchange-linked (Binance, Coinbase, OKX) wallet extensions plus password managers and authenticator apps — consistent with the RAT's credential-harvesting capability observed in ViteVenom.

Unlike typical npm supply-chain malware that fires on `npm install` via lifecycle scripts, the ViteVenom payload is embedded in package code and executes at **import time**, i.e. only when a victim's application actually `require()`s or `import`s the compromised module. This delays and narrows detection: static install-time scanners and CI dependency-audit gates that only monitor postinstall hooks will miss it, and the malware only fires in developer/build/runtime contexts that actually load the code path.

The C2 design is a four-tier blockchain dead-drop chain that avoids any seizable domain or IP as the primary channel:
- **Tier 1 (per-package):** each of the seven packages resolves to its own dedicated Tron wallet address, giving the actor compartmentalized, disposable distribution — burning one package's Tier-1 wallet does not affect the others.
- **Tier 2 (shared, campaign-wide):** all seven packages converge on the same shared Tron wallet, the same Aptos account, and the same BSC transaction chain — this is the infrastructure fingerprint that links ViteVenom to ChainVeil.
- **Tier 3/4 (payload relay):** the loader queries the Tron blockchain (via the public TronGrid API, api.trongrid.io) for the attacker's latest transaction, decodes/reverses the transaction data field to derive a BSC transaction hash, queries that BSC transaction (via bsc-dataseed.binance.org / bsc-rpc.publicnode.com) for an encrypted payload carried in the transaction's input field, and decrypts it with a hard-coded key before executing it. If Tron resolution fails, the loader falls back to the Aptos account (fullnode.mainnet.aptoslabs.com) before continuing the same BSC relay step. Because dead-drop transaction data on a public blockchain is immutable and cannot be taken down by registrars, hosting providers, or law enforcement seizure the way a domain or IP can, the C2 channel is resistant to conventional infrastructure takedown.
- **Fallback:** if the entire blockchain resolution chain fails, the loader falls back to fetching the RAT payload directly from a traditional HTTP C2 server.

Once resolved and decrypted, the delivered payload is a full-featured Remote Access Trojan (RAT) providing the operator: an interactive reverse shell, harvesting of locally stored credentials (browser-stored, config files, environment secrets, and per ChainVeil's documented scope, cryptocurrency-wallet browser extensions and password managers), file-system exfiltration, and installation of a persistent backdoor. Checkmarx's remediation guidance specifically calls out inspecting shell profile files (.bashrc, .zshrc, .profile) for unauthorized modifications, indicating the backdoor establishes persistence via shell RC file injection in addition to any in-application persistence.

The blockchain dead-drop C2 pattern used by ViteVenom/ChainVeil is not unique tradecraft — it is part of a broader 2026 proliferation of blockchain-based dead-drop resolvers across independent npm supply-chain campaigns, indicating shared tradecraft innovation rather than shared operator identity:
- The astro.config.mjs / PolinRider loader (analyzed by SafeDep, attributed to a DPRK-affiliated actor, reported July 1, 2026) uses a near-identical Tron→Aptos→BSC relay chain.
- JFrog Security Research documented two hijacked npm packages, html-to-gutenberg (v4.2.11) and fetch-page-assets (v1.2.9), published May 25, 2026, that combined a VSCode-autorun-task execution trigger (rather than import-time or postinstall) with the identical Tron/Aptos/BSC dead-drop discovery mechanism (abusing the same api.trongrid.io / fullnode.mainnet.aptoslabs.com / bsc-dataseed.binance.org endpoints) to stage a Socket.io backdoor and a cross-platform Python infostealer targeting browsers, password managers, and cryptocurrency wallets; Nextron Research subsequently found the same malware embedded in 16 additional Go packages, indicating the technique and possibly the toolkit spans well beyond the npm ecosystem. This is a distinct, separately-attributed incident from ViteVenom/ChainVeil, cited here only as evidence the dead-drop design pattern is proliferating.
- An earlier (2024) precedent, the jest-fet-mock npm package (typosquatting fetch-mock-jest / Jest-Fetch-Mock), used a single-chain Ethereum smart-contract `getString()` call as its C2 dead drop — establishing blockchain-dead-drop C2 as a recurring npm supply-chain technique that has since evolved into today's multi-chain (Tron/Aptos/BSC) designs.

No CVE has been assigned; this is a malicious-package supply-chain compromise, not a vulnerability in Vite or vitejs itself. The seven packages have since been reported for takedown; organizations should treat any of the seven package names found in a dependency tree as a confirmed compromise requiring full incident response (credential rotation, shell profile audit, host forensic review), not merely a package removal.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1127 Trusted Developer Utilities Proxy Execution
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1571 Non-Standard Port
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1573 Encrypted Channel
- T1102 Web Service
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1499 Endpoint Denial of Service
- T1657 Financial Theft

## Sources

- [Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT](https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html)
- [Sequel to ChainVeil npm Malware Targets Vite Ecosystem (ViteVenom)](https://checkmarx.com/zero-post/sequel-to-chainveil-npm-malware-targets-vite-ecosystem/)
- [ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey](https://checkmarx.com/zero/research/)
- [astro.config.mjs Supply Chain Attack via Blockchain C2 (related dead-drop technique, PolinRider/DPRK)](https://safedep.io/astro-config-blockchain-c2-supply-chain/)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer](https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/)
- [NPM Account Takeover Results in Crypto Supply Chain Attack (blockchain-C2 npm tradecraft background)](https://checkmarx.com/blog/npm-account-takeover-results-in-crypto-supply-chain-attack/)
- [jest-fet-mock: Blockchain-Based C2 Supply Chain Attack (Ethereum smart-contract dead-drop precedent)](https://www.infosecurity-magazine.com/news/supply-chain-attack-smart/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1461