# Seven Malicious Vite npm Packages Deliver RAT Blockchain-based command and control system targets the software supply chain. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-17 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0c5f7d9b-1d11-408e-9359-c0568beb562e ## Software Supply Chain Attack Seven malicious npm packages target the Vite frontend ecosystem, launching a software supply chain attack. These packages are considered an expansion of the ChainVeil campaign and use a blockchain-based command and control (C2) infrastructure. ## Blockchain-Based C2 Infrastructure The campaign, codenamed ViteVenom by Checkmarx, uses a four-tier C2 infrastructure across Tron, Aptos, and Binance Smart Chain. This infrastructure is used to distribute a remote access trojan (RAT) and is extremely difficult to disable. ## SuccessKey Threat The attacks are attributed to a threat actor named SuccessKey. Initial malicious activities were detected on February 27, 2026, and cryptocurrency wallets linked to ViteVenom were activated. ## Package Distribution Packages published between June 29 and July 3, 2026, target developers using Vite JavaScript and frontend build tools. The packages mimic the '@vitejs/*' namespace to lend a veneer of legitimacy. ## Loading and Execution Mechanism The malicious code does not execute at install time but at import time, limiting endpoint security detections. The code accesses the blockchain infrastructure to load the next stage. ## User Precautions Users who have installed the packages are advised to remove them immediately, audit dependencies, and rotate all credentials. Additionally, unauthorized modifications to .bashrc, .zshrc, and .profile files should be checked. ## Sources covering this story - https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._