cyber.hendryadrian.com
Threat Research · opensourcemalware.com

Researchers Link ChainVeil and ViteVenom npm Malware to DPRK’s PolinRider Campaign

· Original article ↗

Summary

OpenSourceMalware links the ChainVeil and ViteVenom npm campaigns to PolinRider, citing identical blockchain wallets and XOR keys, shared markers, and overlapping targeting of developer tools.

Key points

  • The analysis links nine ChainVeil npm packages and seven ViteVenom packages to the PolinRider campaign.
  • The authors cite identical TRON wallets, an Aptos address, and two XOR keys previously published in their PolinRider research.
  • They report that ChainVeil used a multi-tier blockchain command channel involving TRON, Aptos, and Binance Smart Chain.
  • The campaigns used typosquatted packages targeting Tailwind-related tools and the Vite ecosystem.
  • The authors attribute PolinRider to North Korea's Lazarus Group, citing shared infrastructure and tradecraft.

Article Details

Attack Vectors
  • Malicious npm packages typosquatted names in the Tailwind and Vite ecosystems.
  • The ChainVeil packages delivered a reported 77KB remote access trojan.
  • The malware's command channel used TRON, Aptos, and Binance Smart Chain infrastructure.
Defensive Notes
  • Treat the package versions identified in the article as malicious, including versions that may still be live or may have been removed or replaced with security placeholders.
  • Correlate ChainVeil and ViteVenom indicators with PolinRider: the article reports byte-for-byte matches in two TRON wallets, an Aptos address, and two XOR keys.
  • The article cautions that blockchain-based attribution has limitations and that shared infrastructure-as-a-service cannot be ruled out.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe campaign distributed malicious packages through the npm ecosystem, including typosquatted packages targeting Tailwind and Vite tooling.

People

Paul McCartyDiscussed the A6-prefixed marker pattern in DPRK-owned packages on Episode #10 of the podcast.

Threat Actors

Lazarus GroupThe article attributes PolinRider to Lazarus Group and assesses ChainVeil and ViteVenom as part of PolinRider.SuccessKeyCheckmarx named the ChainVeil operator SuccessKey; the article argues ChainVeil is part of PolinRider rather than a separate campaign.

Products

npmOn June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT),Tailwind#10 of our podcast, where Paul McCarty talked about seeing the same pattern in DPRK-owned packages tailwind-color-shades (marker a6-shadow-15) and secure-box (marker a6-orion-271). A naming scheme that persistsViteweeks later, on July 14, they followed up with a sequel on "ViteVenom," seven typosquats targeting the Vite ecosystem. They assessed with high confidence that it shares an operator with ChainVeil, while noting that

Related Articles