# ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaign

> Malpedia and multiple security vendors link two blockchain-C2 malware families, ChainVeil and ViteVenom, to the North Korean (DPRK) supply-chain campaign PolinRider. ViteVenom impersonates the @vitejs/* npm namespace to deliver a RAT via a four-tier Tron/Aptos/Binance-Smart-Chain dead-drop resolver, while the broader PolinRider operation has planted obfuscated JavaScript loaders in nearly 2,000 GitHub repositories and 108+ malicious packages/extensions across npm, Packagist, Go modules, and Chrome.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1570
- **ID:** TL-2026-1570
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** PolinRider (North Korea)
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PolinRider is a North Korea-linked (DPRK) open-source supply-chain campaign, assessed by OpenSourceMalware, Socket.dev, and Checkmarx researchers to be connected to the Lazarus Group ecosystem via overlaps with the Contagious Interview / Famous Chollima cluster and prior TaskJacker and Fake Font activity. The campaign has been tracked since at least December 2025 (with anti-dated commits reaching back to January 2026) and was first publicly disclosed on 2026-03-07 with 675 compromised GitHub repositories across 352 owners; by 2026-04-12 that footprint had grown to 1,951 repositories across 1,047 owners, and further supply-chain hijacking activity continued through July 2026.

Two malware families sit at the center of the most recent reporting. ChainVeil is a JavaScript RAT-delivery mechanism that uses an 'unprecedented' four-tier blockchain-based command-and-control architecture spanning the Tron blockchain (primary payload retrieval), Aptos (fallback address for backup delivery), and Binance Smart Chain (encrypted payload storage embedded in transaction input fields). ChainVeil was distributed via unscoped npm typosquats (e.g., 'rate-limit-flexible'). ViteVenom, identified by Checkmarx researchers, is a direct expansion of ChainVeil that instead uses scoped package names impersonating the legitimate '@vitejs/*' npm namespace to lend an air of authenticity to seven malicious packages published between 2026-06-29 and 2026-07-03: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui. ChainVeil and ViteVenom share tier-2 C2 infrastructure -- identical Tron wallet and Aptos account addresses feeding into the same Binance Smart Chain transaction used to deliver the RAT payload -- and are attributed via cryptocurrency wallet analysis to an actor cluster tracked as 'SuccessKey', assessed to be linked to PolinRider and, transitively, to DPRK state-directed activity.

The ViteVenom/ChainVeil infection chain executes malicious code at package IMPORT time rather than npm install time, which helps evade install-time scanners: the payload first queries the Tron blockchain for the latest attacker wallet transaction, decodes the transaction data to obtain a Binance Smart Chain transaction hash, retrieves an encrypted second-stage payload from that BSC transaction's input field, and decrypts it using a hard-coded key. If the blockchain resolution path fails, a fallback mechanism retrieves the RAT directly over HTTP. The delivered RAT provides reverse shell access, credential harvesting, file exfiltration, persistent backdoor injection, and unauthorized modification of shell profile files (.bashrc, .zshrc, .profile) to achieve persistence. Activity consistent with this cluster was observed as early as 2026-02-27.

The wider PolinRider operation (which OpenSourceMalware and Socket.dev track as the umbrella campaign encompassing ChainVeil/ViteVenom) relies on a social-engineering front: operators pose as recruiters or collaborators on LinkedIn, GitHub, and freelance platforms using fabricated companies and AI-generated profiles, delivering weaponized take-home 'interview' coding tests. Two named lure templates have been documented: 'ShoeVista', a fake Tailwind CSS e-commerce interview exercise responsible for at least 34 developer uploads of the trojanized tailwindcss-style-animate package (and related variants tailwind-mainanimation, tailwind-autoanimation, tailwindcss-typography-style, tailwindcss-style-modify, tailwindcss-animate-style); and 'StakingGame', a fake blockchain/VS Code project template (UUID e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9). Malicious JavaScript loaders are appended -- after whitespace padding to hide the code from casual review -- to legitimate-looking configuration files such as postcss.config.mjs, tailwind.config.js, eslint.config.mjs, next.config.mjs, babel.config.js, vite.config.js, and app.js. A secondary concealment technique embeds obfuscated JavaScript inside fake .woff2 font files, and a third abuses VS Code's .vscode/tasks.json 'runOn: folderOpen' auto-execution trigger to run payloads the moment a victim opens a compromised project in the editor -- a technique the campaign shares with the related 'Fake Font' and 'TaskJacker' clusters. Operators cover their tracks with git history manipulation, using a Windows batch script (temp_auto_push.bat) that manipulates system time to force-push and anti-date malicious commits so they blend into legitimate commit history.

By 2026-07-01, PolinRider's footprint had expanded across four separate ecosystems: npm, Packagist (PHP/Composer), Go modules, and a malicious Google Chrome extension, totaling 162 malicious release artifacts across 108 unique packages/extensions (19 npm, 10 Packagist, 61 Go modules, 1 Chrome extension, plus additional PyPI targeting). The Go-module and Packagist expansion (bulk account takeover confirmed 2026-06-23, cross-ecosystem spread confirmed 2026-07-01) exploited the fact that both ecosystems treat 'a git commit as a published release' -- meaning a single compromised maintainer account grants direct supply-chain distribution without needing separate registry publishing credentials. Confirmed Packagist targets include thiio/kubernetes-php-sdk, arsl/optima-class, olc/olc-php, sevenspan/laravel-whatsapp, adxio/twig-hmvc, sevenspan/code-generator, lambda-platform/moqup, roberts/leads, sevenspan/laravel-chat, and plusinfolab/logstation. High-impact compromised GitHub organizations/accounts include the sparktechagency organization (12 affected repos), the coderkhalide account (4 compromised repos, 349 followers), and the widely-starred Neutralinojs project (8,400 stars), illustrating the campaign's potential blast radius through popular open-source dependencies.

Payloads delivered by the broader PolinRider infrastructure include the DEV#POPPER remote access trojan and the OmniStealer information-stealer, both of which communicate with the same TRON/Aptos/BNB Smart Chain blockchain dead-drop infrastructure documented for ChainVeil/ViteVenom. Separate HTTP-based C2 fallback uses Vercel-hosted endpoints following the pattern https://<subdomain>.vercel.app/settings/(mac|linux|win)?flag=<N>, observed across subdomains including 260120.vercel.app, default-configuration.vercel.app, vscode-settings-bootstrap.vercel.app, vscode-settings-config.vercel.app, vscode-bootstrapper.vercel.app, and vscode-load-config.vercel.app. Malpedia's own library entry additionally cross-references this cluster with JADESNOW, BeaverTail, and InvisibleFerret malware families and a related report on Lazarus Group's use of Git hooks to conceal malware (published 2026-05-05), reinforcing the Lazarus/DPRK attribution chain. A BeaconBeagle infrastructure-correlation check against the disclosed C2 domain space returned no additional matches at the time of this research, indicating no further public/private beacon telemetry has yet been indexed for this cluster.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1587.001 Malware
- T1583.006 Web Services
- T1586 Compromise Accounts
- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1566.003 Spearphishing via Service
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1053 Scheduled Task/Job
- T1546.004 Unix Shell Configuration Modification
- T1547 Boot or Logon Autostart Execution
- T1505.005 Terminal Services DLL
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Timestomp
- T1140 Deobfuscate/Decode Files or Information
- T1684.001 Impersonation
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1074.001 Local Data Staging
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1568 Dynamic Resolution
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography
- T1090.003 Multi-hop Proxy
- T1102.002 Bidirectional Communication
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [ChainVeil and ViteVenom are DPRK's PolinRider Campaign](https://malpedia.caad.fkie.fraunhofer.de/library/aadad501-e911-4fc6-a35f-7463531046da/)
- [Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT](https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html)
- [North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign](https://thehackernews.com/2026/07/north-korean-hackers-publish-108.html)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [PolinRider Jumps the Fence to Go, Packagist, npm, PyPI](https://opensourcemalware.com/blog/polinrider-jumps-the-fence)
- [PolinRider Rides Again: North Korean Attack Expands Across GitHub](https://opensourcemalware.com/blog/polinrider-rides-again-north-korean-attack-expands-across-github)
- [New npm malware cluster targets Vite ecosystem](https://www.scworld.com/brief/new-npm-malware-cluster-targets-vite-ecosystem)
- [ViteVenom Targets Vite Developers With Blockchain Malware](https://www.cointrust.com/market-news/vitevenom-targets-vite-developers-with-blockchain-malware/amp)
- [PolinRider - Mallory.ai malware profile](https://www.mallory.ai/malware/019cd938-8511-7560-a9ca-2921a859df50)
- [Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT](https://www.guardianmssp.com/2026/07/17/seven-malicious-vite-npm-packages-use-blockchain-c2-to-deliver-a-rat/)
- [North Korean Hackers Target Open Source Developers in Supply Chain Attacks](https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/)
- [PolinRider supply chain attack expands to Packagist ecosystem](https://www.developer-tech.com/news/polinrider-supply-chain-attack-expands-packagist-ecosystem/)
- [PolinRider Supply Chain Attack Hits 108 Packages](https://howtofix.guide/polinrider-supply-chain-attack-developer-packages/)
- [PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos (GitHub research repo)](https://github.com/OpenSourceMalware/PolinRider)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1570