Checkmarx has disclosed ViteVenom, a supply-chain campaign built around seven malicious npm packages that impersonate the official @vitejs/* scope to target developers using the Vite frontend build tool. The campaign is a direct sequel to ChainVeil, a similar operation the same firm documented in June, and both are attributed to a threat actor Checkmarx tracks as SuccessKey. What sets this family apart from the usual typosquat-and-postinstall-hook playbook is its command-and-control channel: instructions and payload locations are pulled from live transactions on public blockchains, not from a domain or IP that can be sinkholed or seized.

What Happened

ChainVeil, disclosed in mid-June 2026, used unscoped typosquats (package names like rate-limit-flexible variants) to catch developers making small typos. ViteVenom is a deliberate escalation: rather than relying on typos, the seven packages identified by Checkmarx use scoped names inside the @vitejs/* namespace, borrowing the legitimacy that a scope conveys to developers who’ve learned to trust official-looking prefixes. The packages were published to the npm registry between June 29 and July 3, 2026. On-chain evidence — wallets tied to the campaign’s infrastructure — shows activity going back to February 27, 2026, meaning the operation was staged for roughly four months before the packages went live.

Technical Details

The malicious logic does not fire at install time via a preinstall/postinstall hook, the pattern most endpoint and registry scanners are tuned to catch. Instead, it executes at import time — the first time the package is actually require()’d or imported into a build — which meaningfully narrows the detection window and evades tooling that only inspects install-phase scripts.

Once triggered, the payload initiates what Checkmarx describes as a four-tier blockchain-based C2 infrastructure:

  • The malware first queries the Tron blockchain, reading the latest transaction sent from an attacker-controlled wallet. Transaction data (not the wallet address itself, which stays static) encodes the current C2 endpoint or payload pointer.
  • If the Tron lookup fails or is unavailable, the malware falls back to Aptos as a secondary chain for the same transaction-data lookup.
  • Binance Smart Chain rounds out the infrastructure, giving the operators a third independent channel to rotate through.

Because the actual C2 location lives inside transaction data on public, immutable, permissionless ledgers, there is no domain to take down and no centralized server to seize — defenders can only block known wallet addresses, and the operator can simply broadcast a new transaction from a fresh wallet to keep the channel alive.

The delivered payload is a full-featured RAT capable of:

  • Spawning a reverse shell for interactive access
  • Harvesting credentials from the local system and browser stores
  • Exfiltrating files from the compromised host
  • Installing a persistent backdoor for follow-on access

This is consistent with SuccessKey’s established goal in the ChainVeil campaign: broad access and credential/wallet theft from developer machines, rather than a self-propagating worm.

Impact

Any project that added one of the seven ViteVenom packages between late June and early July, or that pulls dependencies without pinning and lockfile verification, is at risk of having pulled a poisoned import into a build or CI pipeline. Because the payload triggers on import rather than install, a package sitting unused in node_modules isn’t necessarily dangerous — but the moment build tooling actually imports it, the RAT deploys. Organizations running Vite-based frontend builds — a large share of the modern JavaScript/TypeScript ecosystem — are the direct targets; developer laptops and CI/CD runners that resolve npm dependencies without scope-verification are the practical blast radius.

Mitigation

  • Audit package-lock.json/pnpm-lock.yaml for any dependency resolving to the seven flagged packages and remove them immediately; treat any host that imported them as compromised and rotate credentials, tokens, and SSH keys present on that machine.
  • Do not trust the @vitejs/* scope by name alone — verify packages resolve to the actual maintainers-controlled npm org, and cross-check against the official Vite plugin registry.
  • Add import-time (not just install-time) behavioral monitoring to CI/CD pipelines; static, install-hook-only scanning will miss this class of payload entirely.
  • Block or alert on outbound calls to blockchain RPC endpoints (Tron, Aptos, BSC nodes) from build and CI environments where such traffic has no legitimate business purpose.
  • Watch for follow-up advisories, since SuccessKey has now iterated this tradecraft twice (ChainVeil in June, ViteVenom in July) and is likely to target additional scopes or ecosystems next.

Sources