ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)

ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets (TL-2026-1572), also tracked as ViteVenom, is a high-severity supply-chain compromise, first published 2026-07-20 and last reviewed 2026-08-04. It is attributed to SuccessKey (North Korea) with low confidence, affects npm registry (unofficial/malicious scopes) @uw010010/vite-tree, maps to 30 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 42 indicators of compromise.

Key facts for TL-2026-1572

Threat ID
TL-2026-1572
Also known as
ViteVenom, js.jadesnow
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-20
Last reviewed
2026-08-04
Attribution
SuccessKey
Attribution confidence
LOW
Nation-state nexus
North Korea
Motivation
ESPIONAGE
Target sectors
technology, softwaredevelopment
Target regions
Global
Detection rules
9
Indicators of compromise
42
Updates
2026-08-04

Malware and tooling in ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

Malware and tooling: ChainVeil, DEV#POPPER, OmniStealer, ViteVenom

Checkmarx identified seven malicious scoped npm packages impersonating the Vite build tool ecosystem, published June 29-July 3, 2026 (2,420 combined downloads), delivering a 77KB Remote Access Trojan dubbed ViteVenom via an unprecedented four-tier blockchain-based (Tron, Aptos, Binance Smart Chain) command-and-control system. The campaign shares Tier-2 blockchain wallets, XOR decryption keys, the BSC delimiter, and the identical 77KB RAT payload with the earlier ChainVeil npm malware cluster, and is assessed by researchers to overlap with the North Korea-linked PolinRider supply-chain activity cluster (Contagious Interview / Famous Chollima).

How ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets works

ViteVenom is a supply-chain malware campaign discovered by Checkmarx researcher Pavan Gudimalla, delivered through seven malicious scoped npm packages that typosquat/impersonate the legitimate @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui. Combined the packages accrued 2,420 downloads before being reported to and removed from npm on July 3, 2026, though the attacker-controlled C2 infrastructure remained operational after takedown.

Each package ships an identical malicious file, bin/vite.js, differing only by an embedded campaign marker (global.i='*5-*'). Execution begins at import time rather than install time, reducing the detection window for endpoint security tooling. The loader obfuscates sensitive identifiers (require, module) as single-letter variables and stores sensitive strings in a 653-character scrambled array (_$_4445) decoded via a deterministic character-swap algorithm into 63 elements, with anti-tampering checks that silently exit if the array is modified, and a 30-second anti-replay cooldown to prevent duplicate executions.

The malware's defining feature is an 'unprecedented' four-tier blockchain command-and-control resolution chain spanning three independent blockchains: it queries a Tron wallet (api.trongrid.io) for the latest transaction, hex-decodes and reverses the transaction data to yield a Binance Smart Chain (BSC) transaction hash, queries that BSC transaction (via eth_getTransactionByHash against bsc-dataseed.binance.org or the bsc-rpc.publicnode.com fallback) to extract an encrypted payload embedded in the transaction input field (delimited by the marker '?.?' separating junk prefix from ciphertext), and XOR-decrypts the payload with a hardcoded key. If the Tron lookup fails, the loader falls back to an Aptos wallet (fullnode.mainnet.aptoslabs.com) instead, storing the BSC hash as the transfer destination address rather than the wallet identifier.

Two parallel execution stages follow blockchain resolution: Stage 2A fetches a payload via the blockchain chain described above, XOR-decrypts it with key '2[gWfGj;<:-93Z^C', and executes it directly via eval() in the main thread. Stage 2B spawns a fully detached, hidden child process (child_process.spawn with detached:true, stdio:'ignore', windowsHide:true) that bypasses the blockchain entirely and instead performs an HTTP GET to a hardcoded C2 server endpoint (/$/boot on 198.105.127.210) to retrieve the final 77KB Remote Access Trojan payload directly, decrypting it with a separate XOR key (ThZG+0jfXE6VAGOJ; Stage 2B's own blockchain-delivered payload uses key 'm6:tTh^D)cBz?NM]'). The resulting RAT provides reverse-shell command execution, credential harvesting, file exfiltration, and persistent backdoor injection, and establishes persistence by appending whitespace-padded entries to shell rc files (.bashrc, .zshrc, .profile) and by writing a machine-identifying file (machineId) to a hidden directory for victim fingerprinting.

Checkmarx assesses ViteVenom is directly linked to the earlier ChainVeil npm malware cluster (which targeted Tailwind CSS, Sass, and ORM-adjacent packages beginning May 18, 2026, with a burst of 9 packages June 6-10, 2026): the two campaigns share identical Tier-2 blockchain wallets (Tron TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v; Aptos 0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1), identical XOR decryption keys for both stages, an identical BSC delimiter, and byte-identical 77KB RAT payloads, with synchronized blockchain deployment timing (a 0.3-second Aptos transaction delta on Stage 2B wallet activation, February 27, 2026). The two clusters are operationally compartmentalized via distinct Tier-1 (campaign-specific) wallets, distinct npm maintainer accounts, distinct malicious file paths (bin/vite.js for ViteVenom vs. lib/lib.min.js for ChainVeil), and distinct dedicated C2 hosts (198.105.127.210 for ViteVenom vs. 166.88.54.158 primary / 23.27.202.27 tertiary MongoDB-exposing host for ChainVeil), consistent with either a single operator running parallel campaigns or a shared Malware-as-a-Service (MaaS) blockchain-C2 provider serving multiple npm-poisoning operators.

External researchers (OpenSourceMalware, via The Hacker News reporting) additionally assess overlap between this blockchain-C2 wallet/key infrastructure and the PolinRider campaign, a broader North Korea-linked (Contagious Interview / Famous Chollima cluster) supply-chain operation that Socket's Threat Research Team documented across 108 unique packages (162 malicious release artifacts) spanning npm, Packagist, Go modules, and one Chrome extension, delivering the DEV#POPPER RAT and the OmniStealer credential/wallet/browser-data stealer via obfuscated JavaScript loaders, whitespace-padded fake .woff2 loader files, anti-dated/force-pushed Git history rewrites, and VS Code task-file (`runOn: folderOpen`) auto-execution triggers targeting developer maintainer accounts. If the ChainVeil/ViteVenom-to-PolinRider link holds, this places the blockchain-C2 npm supply-chain tooling within a nation-state-linked, MaaS-style development-targeting operation rather than a purely financially motivated actor, though Checkmarx's own naming (attributing ChainVeil to an actor referenced as 'SuccessKey') and the PolinRider attribution are currently reported by separate research teams and should be treated as an assessed overlap rather than a confirmed single-actor conclusion.

MITRE ATT&CK techniques used in TL-2026-1572

Command and Control

T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Collection

T1005 Data from Local System; T1074 Data Staged

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Initial Access

T1195 Supply Chain Compromise

Persistence

T1505 Server Software Component; T1546 Event Triggered Execution

Credential Access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Impact

T1657 Financial Theft

Affected products and versions in ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

  • npm registry (unofficial/malicious scopes) — @uw010010/vite-tree
    Vulnerable versions: 3.4.2; 3.4.3; 3.6.1
    Fixed in: package removed from npm 2026-07-03; clean versions 3.4.1 and 8.1.0 were not malicious
  • npm registry (unofficial/malicious scopes) — @vite-tab/tab
    Vulnerable versions: 3.15.10
    Fixed in: package removed from npm 2026-07-03
  • npm registry (unofficial/malicious scopes) — @vite-ln/build-ts
    Vulnerable versions: 5.15.10
    Fixed in: package removed from npm 2026-07-03
  • npm registry (unofficial/malicious scopes) — @vite-mcp/vite-type
    Vulnerable versions: 6.44.1
    Fixed in: package removed from npm 2026-07-03
  • npm registry (unofficial/malicious scopes) — @vite-pro/vite-ui
    Vulnerable versions: 2.5.10
    Fixed in: package removed from npm 2026-07-03
  • npm registry (unofficial/malicious scopes) — @vitets/vite-ts
    Vulnerable versions: 1.5.10
    Fixed in: package removed from npm 2026-07-03
  • npm registry (unofficial/malicious scopes) — @vite-ts/vite-ui
    Vulnerable versions: 6.44.1
    Fixed in: package removed from npm 2026-07-03

Remediation for ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

Immediate actions

  • Audit installed npm dependencies for the seven named malicious packages and any version matching the reported malicious releases; remove and reinstall from verified @vitejs scope only
  • Block outbound traffic to C2 hosts 198.105.127.210, 166.88.54.158, and 23.27.202.27 at perimeter/proxy
  • Search endpoint file systems for bin/vite.js containing the campaign marker global.i='*5-*' and for lib/lib.min.js (ChainVeil variant)
  • Inspect shell rc files (.bashrc, .zshrc, .profile) on developer workstations and CI runners for whitespace-padded/anomalous appended entries
  • Rotate credentials and API tokens on any host that executed the malicious packages, given confirmed credential-harvesting RAT capability
  • Query internal DNS/proxy logs for lookups to api.trongrid.io, fullnode.mainnet.aptoslabs.com, bsc-dataseed.binance.org, and bsc-rpc.publicnode.com originating from build/CI systems where blockchain RPC traffic is not expected

Workarounds

  • Until packages are fully purged from lockfiles/caches, isolate CI runners that installed the affected packages from production credential stores and re-image before reuse

Longer-term hardening

  • Deploy a private npm registry proxy / dependency firewall that blocks unscoped or newly-published packages from auto-installing in CI
  • Enforce package-name allowlisting and typosquat-similarity checks against the @vitejs scope and other high-value build-tool namespaces
  • Monitor outbound traffic from build/CI environments for blockchain RPC endpoints (Tron, Aptos, BSC) as a general detection signal, since legitimate build tooling has no reason to contact these
  • Implement dependency pinning with lockfile integrity verification (npm ci with committed lockfiles) and periodic SBOM diffing for CI pipelines
  • Establish a maintainer-account security baseline (mandatory hardware-key 2FA, publish-access review) for internal packages to reduce account-takeover risk seen in the broader PolinRider cluster

Weaknesses (CWE) in ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

CWE-506, CWE-829, CWE-494

Timeline of ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

  • Stage 2B Tron and Aptos wallets activated with a 0.3-second synchronization delta between the two blockchain transactions, later used as evidence linking ChainVeil and ViteVenom to shared infrastructure.
  • ChainVeil Tier-1 wallets funded and blockchain C2 infrastructure expanded ahead of the campaign's npm publishing phase.
  • First ChainVeil malicious npm packages published, targeting Tailwind CSS, Sass, and ORM-adjacent package names via the lib/lib.min.js malicious file.
  • ViteVenom's Stage 2A blockchain C2 pointer updated (24th rotation observed), indicating active pre-positioning of the ViteVenom-specific infrastructure ahead of public package distribution.
  • ChainVeil campaign burst of 9 additional malicious npm packages published between June 6 and June 10, 2026.
  • ViteVenom malicious npm packages begin publishing under scoped names impersonating the @vitejs ecosystem, starting the June 29-July 3 distribution window.
  • Socket's Threat Research Team publishes findings on the broader PolinRider campaign, documenting 108 unique packages (162 malicious release artifacts) across npm, Packagist, Go modules, and Chrome extensions delivering DEV#POPPER and OmniStealer, and attributing the cluster to North Korea-linked Contagious Interview / Famous Chollima activity.
  • Both the ViteVenom and ChainVeil malicious package clusters are reported to npm and removed from the registry; the attacker-controlled C2 servers (198.105.127.210, 166.88.54.158, 23.27.202.27) remain operational after takedown.
  • Checkmarx researcher Pavan Gudimalla publishes technical analysis 'Sequel to ChainVeil npm Malware Targets Vite Ecosystem,' naming the RAT ViteVenom and detailing the four-tier blockchain C2 mechanism; Malpedia catalogs the family as js.jadesnow.
  • The Hacker News and multiple security outlets (SC Media, BackBox, Network Security Magazine) report on the ViteVenom disclosure, adding OpenSourceMalware's assessment linking the shared Tron/Aptos wallets and XOR keys to the PolinRider activity cluster.
  • TL-Intel Harness ingests the campaign via the Malpedia RSS feed and completes RESEARCH-phase analysis correlating Checkmarx, Malpedia, and PolinRider reporting.

Update history for TL-2026-1572

  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 117 community-related indicator(s).

Sources cited for ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

Threats related to ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets

Detection coverage for TL-2026-1572

As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1572 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1572

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats