# ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)

> Checkmarx identified seven malicious scoped npm packages impersonating the Vite build tool ecosystem, published June 29-July 3, 2026 (2,420 combined downloads), delivering a 77KB Remote Access Trojan dubbed ViteVenom via an unprecedented four-tier blockchain-based (Tron, Aptos, Binance Smart Chain) command-and-control system. The campaign shares Tier-2 blockchain wallets, XOR decryption keys, the BSC delimiter, and the identical 77KB RAT payload with the earlier ChainVeil npm malware cluster, and is assessed by researchers to overlap with the North Korea-linked PolinRider supply-chain activity cluster (Contagious Interview / Famous Chollima).

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-08-04T20:00:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1572
- **ID:** TL-2026-1572
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** SuccessKey (North Korea)
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ViteVenom is a supply-chain malware campaign discovered by Checkmarx researcher Pavan Gudimalla, delivered through seven malicious scoped npm packages that typosquat/impersonate the legitimate @vitejs/* namespace: @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui. Combined the packages accrued 2,420 downloads before being reported to and removed from npm on July 3, 2026, though the attacker-controlled C2 infrastructure remained operational after takedown.

Each package ships an identical malicious file, bin/vite.js, differing only by an embedded campaign marker (global.i='*5-*'). Execution begins at import time rather than install time, reducing the detection window for endpoint security tooling. The loader obfuscates sensitive identifiers (require, module) as single-letter variables and stores sensitive strings in a 653-character scrambled array (_$_4445) decoded via a deterministic character-swap algorithm into 63 elements, with anti-tampering checks that silently exit if the array is modified, and a 30-second anti-replay cooldown to prevent duplicate executions.

The malware's defining feature is an 'unprecedented' four-tier blockchain command-and-control resolution chain spanning three independent blockchains: it queries a Tron wallet (api.trongrid.io) for the latest transaction, hex-decodes and reverses the transaction data to yield a Binance Smart Chain (BSC) transaction hash, queries that BSC transaction (via eth_getTransactionByHash against bsc-dataseed.binance.org or the bsc-rpc.publicnode.com fallback) to extract an encrypted payload embedded in the transaction input field (delimited by the marker '?.?' separating junk prefix from ciphertext), and XOR-decrypts the payload with a hardcoded key. If the Tron lookup fails, the loader falls back to an Aptos wallet (fullnode.mainnet.aptoslabs.com) instead, storing the BSC hash as the transfer destination address rather than the wallet identifier.

Two parallel execution stages follow blockchain resolution: Stage 2A fetches a payload via the blockchain chain described above, XOR-decrypts it with key '2[gWfGj;<:-93Z^C', and executes it directly via eval() in the main thread. Stage 2B spawns a fully detached, hidden child process (child_process.spawn with detached:true, stdio:'ignore', windowsHide:true) that bypasses the blockchain entirely and instead performs an HTTP GET to a hardcoded C2 server endpoint (/$/boot on 198.105.127.210) to retrieve the final 77KB Remote Access Trojan payload directly, decrypting it with a separate XOR key (ThZG+0jfXE6VAGOJ; Stage 2B's own blockchain-delivered payload uses key 'm6:tTh^D)cBz?NM]'). The resulting RAT provides reverse-shell command execution, credential harvesting, file exfiltration, and persistent backdoor injection, and establishes persistence by appending whitespace-padded entries to shell rc files (.bashrc, .zshrc, .profile) and by writing a machine-identifying file (machineId) to a hidden directory for victim fingerprinting.

Checkmarx assesses ViteVenom is directly linked to the earlier ChainVeil npm malware cluster (which targeted Tailwind CSS, Sass, and ORM-adjacent packages beginning May 18, 2026, with a burst of 9 packages June 6-10, 2026): the two campaigns share identical Tier-2 blockchain wallets (Tron TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v; Aptos 0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1), identical XOR decryption keys for both stages, an identical BSC delimiter, and byte-identical 77KB RAT payloads, with synchronized blockchain deployment timing (a 0.3-second Aptos transaction delta on Stage 2B wallet activation, February 27, 2026). The two clusters are operationally compartmentalized via distinct Tier-1 (campaign-specific) wallets, distinct npm maintainer accounts, distinct malicious file paths (bin/vite.js for ViteVenom vs. lib/lib.min.js for ChainVeil), and distinct dedicated C2 hosts (198.105.127.210 for ViteVenom vs. 166.88.54.158 primary / 23.27.202.27 tertiary MongoDB-exposing host for ChainVeil), consistent with either a single operator running parallel campaigns or a shared Malware-as-a-Service (MaaS) blockchain-C2 provider serving multiple npm-poisoning operators.

External researchers (OpenSourceMalware, via The Hacker News reporting) additionally assess overlap between this blockchain-C2 wallet/key infrastructure and the PolinRider campaign, a broader North Korea-linked (Contagious Interview / Famous Chollima cluster) supply-chain operation that Socket's Threat Research Team documented across 108 unique packages (162 malicious release artifacts) spanning npm, Packagist, Go modules, and one Chrome extension, delivering the DEV#POPPER RAT and the OmniStealer credential/wallet/browser-data stealer via obfuscated JavaScript loaders, whitespace-padded fake .woff2 loader files, anti-dated/force-pushed Git history rewrites, and VS Code task-file (`runOn: folderOpen`) auto-execution triggers targeting developer maintainer accounts. If the ChainVeil/ViteVenom-to-PolinRider link holds, this places the blockchain-C2 npm supply-chain tooling within a nation-state-linked, MaaS-style development-targeting operation rather than a purely financially motivated actor, though Checkmarx's own naming (attributing ChainVeil to an actor referenced as 'SuccessKey') and the PolinRider attribution are currently reported by separate research teams and should be treated as an assessed overlap rather than a confirmed single-actor conclusion.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1001 Data Obfuscation
- T1008 Fallback Channels
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1104 Multi-Stage Channels
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Sequel to ChainVeil npm Malware Targets Vite Ecosystem (ViteVenom)](https://checkmarx.com/zero-post/sequel-to-chainveil-npm-malware-targets-vite-ecosystem/)
- [ViteVenom (js.jadesnow) — Malpedia Library Entry](https://malpedia.caad.fkie.fraunhofer.de/library/eda34ce1-9195-47f8-a5e9-c3d194121070/)
- [Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT](https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html)
- [New npm malware cluster targets Vite ecosystem](https://www.scworld.com/brief/new-npm-malware-cluster-targets-vite-ecosystem)
- [PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems](https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands)
- [North Korean PolinRider supply chain attack targets 108 unique repos](https://www.scworld.com/news/north-korean-polinrider-supply-chain-attack-targets-108-unique-repos)
- [North Korean Hackers Target Open Source Developers in Supply Chain Attacks](https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/)
- [Active Exploitation Alert: North Korean PolinRider Supply Chain Attack Targets npm, Packagist, Go Modules, and Chrome Extensions](https://www.rescana.com/post/active-exploitation-alert-north-korean-polinrider-supply-chain-attack-targets-npm-packagist-go-modules-and-chrome-extens)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1572