Seven Malicious Vite npm Packages Deliver RAT
Blockchain-based command and control system targets the software supply chain.
1Software Supply Chain Attack
Seven malicious npm packages target the Vite frontend ecosystem, launching a software supply chain attack. These packages are considered an expansion of the ChainVeil campaign and use a blockchain-based command and control (C2) infrastructure.
2Blockchain-Based C2 Infrastructure
The campaign, codenamed ViteVenom by Checkmarx, uses a four-tier C2 infrastructure across Tron, Aptos, and Binance Smart Chain. This infrastructure is used to distribute a remote access trojan (RAT) and is extremely difficult to disable.
3SuccessKey Threat
The attacks are attributed to a threat actor named SuccessKey. Initial malicious activities were detected on February 27, 2026, and cryptocurrency wallets linked to ViteVenom were activated.
4Package Distribution
Packages published between June 29 and July 3, 2026, target developers using Vite JavaScript and frontend build tools. The packages mimic the '@vitejs/*' namespace to lend a veneer of legitimacy.
5Loading and Execution Mechanism
The malicious code does not execute at install time but at import time, limiting endpoint security detections. The code accesses the blockchain infrastructure to load the next stage.
6User Precautions
Users who have installed the packages are advised to remove them immediately, audit dependencies, and rotate all credentials. Additionally, unauthorized modifications to .bashrc, .zshrc, and .profile files should be checked.
Original article: The Hacker News — Yedi Kötü Amaçlı Vite npm Paketi RAT Dağıtıyor