ViteVenom Uses Seven Malicious npm Packages and Blockchain C2 to Deliver a RAT
Summary
Checkmarx identified seven malicious npm packages targeting Vite as part of ViteVenom, an expansion of ChainVeil attributed to SuccessKey. The malware uses blockchain infrastructure to retrieve payloads and deliver a RAT.
Key points
- Checkmarx identified seven scoped npm packages targeting Vite; they were published from June 29 to July 3, 2026, and impersonated the @vitejs namespace.
- ViteVenom is described as an expansion of ChainVeil and attributed to SuccessKey; related wallet activity was detected as far back as February 27, 2026.
- The malicious code runs when a package is imported, rather than when it is installed.
- The loader queries Tron for transaction data, uses it to locate an encrypted payload on Binance Smart Chain, and decrypts that payload with a hard-coded key.
- Aptos provides a backup retrieval method, and an HTTP fallback can fetch the RAT directly from a C2 server.
- The RAT can provide reverse shells, steal credentials, exfiltrate files and establish persistence.
- Users are advised to remove the packages, audit dependencies, rotate credentials and check .bashrc, .zshrc and .profile for unauthorized changes.
Article Details
- Attack Vectors
- Seven malicious scoped npm packages impersonated the @vitejs/* namespace and targeted developers using Vite.
- The packages execute malicious code when imported, rather than at installation time.
- The loader retrieves payload pointers through Tron and Aptos, then extracts an encrypted payload from a Binance Smart Chain transaction and decrypts it with a hard-coded key.
- A fallback retrieves the RAT directly from a C2 server over HTTP, bypassing the blockchain retrieval path.
- The delivered RAT is described as capable of reverse shells, credential harvesting, file exfiltration, and persistent backdoor injection.
- Defensive Notes
- Remove the identified malicious packages and audit dependencies.
- Rotate credentials that may have been exposed.
- Inspect .bashrc, .zshrc, and .profile for unauthorized modifications.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload is encrypted and decrypted by the loader using a hard-coded key.T1071.001 · Web ProtocolsA fallback fetches the RAT directly from the C2 server over HTTP.T1105 · Ingress Tool TransferThe loader retrieves an encrypted payload and next-stage loader, which launches the RAT.T1195.002 · Compromise Software Supply ChainMalicious npm packages targeting Vite developers were used in a software supply chain attack.T1546.004 · Unix Shell Configuration ModificationThe article advises checking .bashrc, .zshrc, and .profile for unauthorized modifications associated with persistence.
People
Threat Actors
Products
npmCheckmarx uncovered ViteVenom, a cluster of seven malicious npm packages targeting developers using the Vite frontend tooling ecosystem in a software supply chain attack.ViteCheckmarx uncovered ViteVenom, a cluster of seven malicious npm packages targeting developers using the Vite frontend tooling ecosystem in a software supply chain attack.