ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaign
ChainVeil and ViteVenom Malware Linked to DPRK PolinRider (TL-2026-1570), also tracked as PolinRider, is a high-severity supply-chain compromise, first published 2026-07-20. It is attributed to PolinRider (North Korea) with medium confidence, affects npm @vitejs/* namespace-impersonating and Vite-ecosystem packages, maps to 35 MITRE ATT&CK techniques (T1005, T1027, T1027.003), and is covered by 9 detection rules and 47 indicators of compromise.
Key facts for TL-2026-1570
- Threat ID
- TL-2026-1570
- Also known as
- PolinRider, ChainVeil, ViteVenom
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution
- PolinRider
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- technology, software-development, open-source-ecosystem, cryptocurrency, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 47
Malware and tooling in ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
Malware and tooling: ChainVeil, DEV#POPPER, OmniStealer, ViteVenom, 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3, 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e, TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP, TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG
Malpedia and multiple security vendors link two blockchain-C2 malware families, ChainVeil and ViteVenom, to the North Korean (DPRK) supply-chain campaign PolinRider. ViteVenom impersonates the @vitejs/* npm namespace to deliver a RAT via a four-tier Tron/Aptos/Binance-Smart-Chain dead-drop resolver, while the broader PolinRider operation has planted obfuscated JavaScript loaders in nearly 2,000 GitHub repositories and 108+ malicious packages/extensions across npm, Packagist, Go modules, and Chrome.
How ChainVeil and ViteVenom Malware Linked to DPRK PolinRider works
PolinRider is a North Korea-linked (DPRK) open-source supply-chain campaign, assessed by OpenSourceMalware, Socket.dev, and Checkmarx researchers to be connected to the Lazarus Group ecosystem via overlaps with the Contagious Interview / Famous Chollima cluster and prior TaskJacker and Fake Font activity. The campaign has been tracked since at least December 2025 (with anti-dated commits reaching back to January 2026) and was first publicly disclosed on 2026-03-07 with 675 compromised GitHub repositories across 352 owners; by 2026-04-12 that footprint had grown to 1,951 repositories across 1,047 owners, and further supply-chain hijacking activity continued through July 2026.
Two malware families sit at the center of the most recent reporting. ChainVeil is a JavaScript RAT-delivery mechanism that uses an 'unprecedented' four-tier blockchain-based command-and-control architecture spanning the Tron blockchain (primary payload retrieval), Aptos (fallback address for backup delivery), and Binance Smart Chain (encrypted payload storage embedded in transaction input fields). ChainVeil was distributed via unscoped npm typosquats (e.g., 'rate-limit-flexible'). ViteVenom, identified by Checkmarx researchers, is a direct expansion of ChainVeil that instead uses scoped package names impersonating the legitimate '@vitejs/*' npm namespace to lend an air of authenticity to seven malicious packages published between 2026-06-29 and 2026-07-03: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui. ChainVeil and ViteVenom share tier-2 C2 infrastructure -- identical Tron wallet and Aptos account addresses feeding into the same Binance Smart Chain transaction used to deliver the RAT payload -- and are attributed via cryptocurrency wallet analysis to an actor cluster tracked as 'SuccessKey', assessed to be linked to PolinRider and, transitively, to DPRK state-directed activity.
The ViteVenom/ChainVeil infection chain executes malicious code at package IMPORT time rather than npm install time, which helps evade install-time scanners: the payload first queries the Tron blockchain for the latest attacker wallet transaction, decodes the transaction data to obtain a Binance Smart Chain transaction hash, retrieves an encrypted second-stage payload from that BSC transaction's input field, and decrypts it using a hard-coded key. If the blockchain resolution path fails, a fallback mechanism retrieves the RAT directly over HTTP. The delivered RAT provides reverse shell access, credential harvesting, file exfiltration, persistent backdoor injection, and unauthorized modification of shell profile files (.bashrc, .zshrc, .profile) to achieve persistence. Activity consistent with this cluster was observed as early as 2026-02-27.
The wider PolinRider operation (which OpenSourceMalware and Socket.dev track as the umbrella campaign encompassing ChainVeil/ViteVenom) relies on a social-engineering front: operators pose as recruiters or collaborators on LinkedIn, GitHub, and freelance platforms using fabricated companies and AI-generated profiles, delivering weaponized take-home 'interview' coding tests. Two named lure templates have been documented: 'ShoeVista', a fake Tailwind CSS e-commerce interview exercise responsible for at least 34 developer uploads of the trojanized tailwindcss-style-animate package (and related variants tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwindcss-animate-style); and 'StakingGame', a fake blockchain/VS Code project template (UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9). Malicious JavaScript loaders are appended -- after whitespace padding to hide the code from casual review -- to legitimate-looking configuration files such as postcss.config.mjs, tailwind.config.js, eslint.config.mjs, next.config.mjs, babel.config.js, vite.config.js, and app.js. A secondary concealment technique embeds obfuscated JavaScript inside fake .woff2 font files, and a third abuses VS Code's .vscode/tasks.json 'runOn: folderOpen' auto-execution trigger to run payloads the moment a victim opens a compromised project in the editor -- a technique the campaign shares with the related 'Fake Font' and 'TaskJacker' clusters. Operators cover their tracks with git history manipulation, using a Windows batch script (temp_auto_push.bat) that manipulates system time to force-push and anti-date malicious commits so they blend into legitimate commit history.
By 2026-07-01, PolinRider's footprint had expanded across four separate ecosystems: npm, Packagist (PHP/Composer), Go modules, and a malicious Google Chrome extension, totaling 162 malicious release artifacts across 108 unique packages/extensions (19 npm, 10 Packagist, 61 Go modules, 1 Chrome extension, plus additional PyPI targeting). The Go-module and Packagist expansion (bulk account takeover confirmed 2026-06-23, cross-ecosystem spread confirmed 2026-07-01) exploited the fact that both ecosystems treat 'a git commit as a published release' -- meaning a single compromised maintainer account grants direct supply-chain distribution without needing separate registry publishing credentials. Confirmed Packagist targets include thiio/kubernetes-php-sdk, arsl/optima-class, olc/olc-php, sevenspan/laravel-whatsapp, adxio/twig-hmvc, sevenspan/code-generator, lambda-platform/moqup, roberts/leads, sevenspan/laravel-chat, and plusinfolab/logstation. High-impact compromised GitHub organizations/accounts include the sparktechagency organization (12 affected repos), the coderkhalide account (4 compromised repos, 349 followers), and the widely-starred Neutralinojs project (8,400 stars), illustrating the campaign's potential blast radius through popular open-source dependencies.
Payloads delivered by the broader PolinRider infrastructure include the DEV#POPPER remote access trojan and the OmniStealer information-stealer, both of which communicate with the same TRON/Aptos/BNB Smart Chain blockchain dead-drop infrastructure documented for ChainVeil/ViteVenom. Separate HTTP-based C2 fallback uses Vercel-hosted endpoints following the pattern https://<subdomain>.vercel.app/settings/(mac|linux|win)?flag=<N>, observed across subdomains including 260120.vercel.app, default-configuration.vercel.app, vscode-settings-bootstrap.vercel.app, vscode-settings-config.vercel.app, vscode-bootstrapper.vercel.app, and vscode-load-config.vercel.app. Malpedia's own library entry additionally cross-references this cluster with JADESNOW, BeaverTail, and InvisibleFerret malware families and a related report on Lazarus Group's use of Git hooks to conceal malware (published 2026-05-05), reinforcing the Lazarus/DPRK attribution chain. A BeaconBeagle infrastructure-correlation check against the disclosed C2 domain space returned no additional matches at the time of this research, indicating no further public/private beacon telemetry has yet been indexed for this cluster.
MITRE ATT&CK techniques used in TL-2026-1570
Collection
T1005 Data from Local System; T1074.001 Local Data Staging
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053 Scheduled Task/Job; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1102.002 Bidirectional Communication; T1132.001 Standard Encoding; T1568 Dynamic Resolution; T1573.001 Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Persistence
T1098 Account Manipulation; T1505.005 Terminal Services DLL; T1546.004 Unix Shell Configuration Modification; T1547 Boot or Logon Autostart Execution
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship; T1566.003 Spearphishing via Service
Credential Access
T1552.001 Credentials In Files; T1555 Credentials from Password Stores
Resource Development
T1583.006 Web Services; T1585 Establish Accounts; T1586 Compromise Accounts; T1587.001 Malware
Impact
stealth
Affected products and versions in ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
- npm — @vitejs/* namespace-impersonating and Vite-ecosystem packages
Vulnerable versions: @uw010010/vite-tree; @vite-tab/tab; @vite-ln/build-ts; @vite-mcp/vite-type; @vite-pro/vite-ui; @vitets/vite-ts; @vite-ts/vite-ui
Fixed in: removed from registry / not affiliated with real @vitejs org - npm — tailwindcss-adjacent packages (ShoeVista lure)
Vulnerable versions: tailwindcss-style-animate ^1.1.6; tailwind-mainanimation; tailwind-autoanimation; tailwindcss-typography-style; tailwindcss-style-modify; tailwindcss-animate-style - Packagist / Composer — PHP packages compromised via maintainer account takeover
Vulnerable versions: thiio/kubernetes-php-sdk; arsl/optima-class; olc/olc-php; sevenspan/laravel-whatsapp; adxio/twig-hmvc; sevenspan/code-generator; lambda-platform/moqup; roberts/leads; sevenspan/laravel-chat; plusinfolab/logstation - Go modules — Go module registry (repository-as-registry compromise)
Vulnerable versions: ~61 confirmed malicious module versions across ~80 compromised modules - Google — Chrome Web Store extension
Vulnerable versions: 1 malicious PolinRider-linked extension - GitHub — Public repositories (via compromised maintainer accounts)
Vulnerable versions: 1,951 confirmed compromised repositories across 1,047 unique owners as of 2026-04-12, including sparktechagency org (12 repos), coderkhalide (4 repos), Neutralinojs (8,400-star project)
Remediation for ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
Immediate actions
- Remove all identified malicious npm packages: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, @vite-ts/vite-ui, tailwindcss-style-animate, tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwindcss-animate-style, and any typosquats such as rate-limit-flexible
- Audit lockfiles and node_modules for the seven ViteVenom packages and ChainVeil typosquats before any CI/CD run
- Rotate all developer and CI credentials on any workstation that imported the affected packages
- Inspect shell profile files (.bashrc, .zshrc, .profile) for unauthorized modifications
- Block outbound traffic to the identified Vercel C2 subdomains (260120.vercel.app, default-configuration.vercel.app, vscode-settings-bootstrap.vercel.app, vscode-settings-config.vercel.app, vscode-bootstrapper.vercel.app, vscode-load-config.vercel.app)
- Audit .vscode/tasks.json in all repositories for runOn: folderOpen triggers
Workarounds
- Rebuild environments from known-good lockfiles rather than trusting existing node_modules trees
- Treat any workstation that imported an affected package as compromised pending full credential rotation
Longer-term hardening
- Deploy import-time (not just install-time) dependency scanning, since the ChainVeil/ViteVenom payload executes on import rather than npm install
- Monitor egress to blockchain RPC endpoints (Tron, Aptos, Binance Smart Chain) from developer and CI environments as an anomaly signal
- Implement mandatory code review and signed-commit verification to detect anti-dated / force-pushed git history manipulation
- Establish takedown/reporting pipeline for scoped npm namespace impersonation (@vitejs/*-style squatting)
- Train developers on Contagious Interview-style recruiter social engineering and fake take-home coding test lures
Weaknesses (CWE) in ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
CWE-506, CWE-829, CWE-494
Timeline of ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
- PolinRider campaign activity begins, with obfuscated JavaScript loaders planted in compromised GitHub repositories delivering DEV#POPPER RAT and OmniStealer.
- Anti-dated malicious commits identified in 7span/Packagist repositories, part of the git-history manipulation technique used to conceal compromise timing.
- Earliest observed activity consistent with the ChainVeil/ViteVenom blockchain-C2 cluster later attributed to the SuccessKey/PolinRider actor.
- OpenSourceMalware publicly discloses the PolinRider campaign: DPRK threat actor implants malware in hundreds of GitHub repositories (675 repos, 352 owners).
- PolinRider's confirmed footprint grows 6.5x since March, reaching 1,951 compromised repositories across 1,047 unique owners.
- Related Malpedia-cross-referenced report published on Lazarus Group's use of Git hooks to hide malware, reinforcing the broader Lazarus/DPRK attribution chain.
- Bulk Go-module compromise achieved via maintainer account takeover, exploiting the Go ecosystem's repository-as-registry publishing model.
- First of seven ViteVenom npm packages impersonating the @vitejs/* namespace published to the npm registry.
- PolinRider's cross-ecosystem spread confirmed across four platforms (npm, Packagist, Go modules, Chrome extensions), totaling 162 malicious release artifacts across 108 unique packages/extensions.
- Final of the seven identified ViteVenom npm packages published; combined package download counts range from 176 to 1,070.
- Malpedia and multiple outlets (The Hacker News, SC Media, Checkmarx research) publish reporting formally linking ViteVenom and ChainVeil to the PolinRider DPRK campaign, detailing the shared four-tier blockchain C2 infrastructure.
- TL-Intel research record compiled from Malpedia, OpenSourceMalware, Socket.dev, The Hacker News, and related open-source reporting; no BeaconBeagle infrastructure correlation matches found for disclosed C2 domains at time of research.
Sources cited for ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
- ChainVeil and ViteVenom are DPRK's PolinRider Campaign
- Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
- North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
- PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems
- PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
- PolinRider Rides Again: North Korean Attack Expands Across GitHub
- New npm malware cluster targets Vite ecosystem
- ViteVenom Targets Vite Developers With Blockchain Malware
- PolinRider - Mallory.ai malware profile
- Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
- North Korean Hackers Target Open Source Developers in Supply Chain Attacks
- PolinRider supply chain attack expands to Packagist ecosystem
- PolinRider Supply Chain Attack Hits 108 Packages
- PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos (GitHub research repo)
Threats related to ChainVeil and ViteVenom Malware Linked to DPRK PolinRider
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)
- PolinRider: DPRK Supply-Chain Campaign Hides BeaverTail/InvisibleFerret Malware in JS Build Config Files (tailwind.config.js et al.)
- PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2
- PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome Extensions
- ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)
Detection coverage for TL-2026-1570
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1570 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.