Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Summary: Checkmarx found seven malicious npm packages, codenamed ViteVenom, that impersonate the @vitejs/* namespace and were published between June 29 and July 3, 2026, as an expansion of the ChainVeil campaign. The packages use a four-tier blockchain-based command-and-control infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan, with malicious code executing at import time rather than install time.
What you should know: The attacker stores payload pointers as transaction data on public blockchains instead of seizable domain names, so taking down the C2 infrastructure is extremely difficult - and the activity overlaps with the PolinRider cluster assessed to be linked to North Korean hackers.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026