ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster) — Threadlinqs Intelligence
As of 2026-07-20, ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster) is a high-severity supply chain threat attributed to SuccessKey (assessed overlap with PolinRider (North Korea (assessed, via PolinRider overlap)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 42 indicators of compromise.
Threat ID: TL-2026-1572 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: SuccessKey (assessed overlap with PolinRider · North Korea (assessed, via PolinRider overlap) · ESPIONAGE
Checkmarx identified seven malicious scoped npm packages impersonating the Vite build tool ecosystem, published June 29-July 3, 2026 (2,420 combined downloads), delivering a 77KB Remote Access Trojan
ViteVenom is a supply-chain malware campaign discovered by Checkmarx researcher Pavan Gudimalla, delivered through seven malicious scoped npm packages that typosquat/impersonate the legitimate @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui. Combined the packages accrued 2,420 downloads before being reported to and removed from npm on July 3, 2026, though the attacker-controlled C2 infrastructure remained operational after takedown.
Each package ships an identical malicious file, bin/vite.js, differing only by an embedded campaign marker (global.i='*5-*'). Execution begins at import time rather than install time, reducing the detection window for endpoint security tooling. The loader obfuscates sensitive identifiers (require, module) as single-letter variables and stores sensitive strings in a 653-character scrambled array (_$_4445) decoded via a deterministic character-swap algorithm into 63 elements, with anti-tampering checks that silently exit if the array is modified, and a 30-second anti-replay cooldown to prevent duplicate executions.
The malware's defining feature is an 'unprecedented' four-tier blockchain command-and-control resolution chain spanning three independent blockchains: it queries a Tron wallet (api.trongrid.io) for the latest transaction, hex-decodes and reverses the transaction data to yield a Binance Smart Chain (BSC) transaction hash, queries that BSC transaction (via eth_getTransactionByHash against bsc-dataseed.binance.org or the bsc-rpc.publicnode.com fallback) to extract an encrypted payload embedded in the transaction input field (delimited by the marker '?.?' separating junk prefix from ciphertext), and XOR-decrypts the payload with a hardcoded key. If the Tron lookup fails, the loader falls back to an Aptos wallet (fullnode.mainnet.aptoslabs.com) instead, storing the BSC hash as the transfer destination address rather than the wallet identifier.
Two parallel execution stages follow blockchain resolution: Stage 2A fetches a payload via the blockchain chain described above, XOR-decrypts it with key '2[gWfGj;<:-93Z^C', and executes it directly via eval() in the main thread. Stage 2B spawns a fully detached, hidden child process (child_process.spawn with detached:true, stdio:'ignore', windowsHide:true) that bypasses the blockchain entirely and instead performs an HTTP GET to a hardcoded C2 server endpoint (/$/boot on 198.105.127.210) to retrieve the final 77KB Remote Access Trojan payload directly, decrypting it with a separate XOR key (ThZG+0jfXE6VAGOJ; Stage 2B's own blockchain-delivered payload uses key 'm6:tTh^D)cBz?NM]'). The resulting RAT provides reverse-shell command execution, credential harvesting, file exfiltration, and persistent backdoor injection, and establishes persistence by appending whitespace-padded entries to shell rc files (.bashrc, .zshrc, .profile) and by writing a machine-identifying file (machineId) to a hidden directory for victim fingerprinting.
Checkmarx assesses ViteVenom is directly linked to the earlier ChainVeil npm malware cluster (which targeted Tailwind CSS, Sass, and ORM-adjacent packages beginning May 18, 2026, with a burst of 9 packages June 6-10, 2026): the two campaigns share identical Tier-2 blockchain wallets (Tron TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v; Aptos 0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1), identical XOR decryption keys for both stages, an identical BSC delimiter, and byte-identical 77KB RAT payloads, with synchronized blockchain deployment timing (a 0.3-second Aptos transaction delta on Stage 2B wallet activation, February 27, 2026). The two clusters are operationally compartmentalized via distinct Tier-1 (campaign-specific) wallets, distinct npm maintainer accounts, distinct malicious file paths (bin/vite.js for ViteVenom vs. lib/lib.min.js for ChainVeil), and distinct dedicated C2 hosts (198.105.127.210 for ViteVe
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, softwaredevelopment
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 42 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1585, T1584, T1587, T1195, T1204, T1059, T1106, T1546, T1505, T1027