Loading malware…
ViteVenom is a malicious npm package cluster targeting developers who use the Vite frontend tooling ecosystem. It is associated with a software supply-chain operation linked by multiple researchers to the earlier ChainVeil activity and, more broadly, to the DPRK-linked PolinRider cluster; some reporting also tracks the operator as SuccessKey. The campaign used scoped package names crafted to resemble legitimate Vite-related tooling and executed its malicious logic at import time rather than through npm install hooks, reducing reliance on lifecycle-script execution and helping evade superficial review and some defensive controls.
The packages functioned as loaders for a multi-stage Node.js remote access trojan. Their command-and-control design used a resilient blockchain-based retrieval chain spanning Tron, Aptos, and Binance Smart Chain, with encrypted stage resolution and decryption keys embedded in the malware. Reported implementations included multiple stages that resolved pointers from blockchain transactions, decrypted follow-on JavaScript, and executed it either in-process or in detached child processes. Some variants also included direct network fallback retrieval for later stages. Researchers linked ViteVenom to ChainVeil through shared Tier-2 blockchain infrastructure, identical XOR decryption keys, overlapping backend infrastructure, and delivery of the same final approximately 77 KB RAT payload.
The delivered malware provided remote shell access, credential harvesting, file exfiltration, and persistence through backdoor injection. Reporting also notes anti-analysis and defense-evasion features such as obfuscated strings, hidden sensitive keywords, anti-tampering checks, anti-replay logic, and environment checks intended to avoid execution in CI or sandbox-like systems. The campaign primarily endangered developer workstations, where compromise could expose source repositories, npm tokens, SSH material, browser sessions, cloud credentials, API keys, and other secrets, creating downstream risk for broader software supply-chain compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earlier this month, Checkmarx and OpenSourceMalware highlighted a set of malicious npm packages collectively referred to as ViteVenom targeting the Vite frontend tooling ecosystem using the same tiered blockchain-based command-and-control (C2) infrastructure to deliver a RAT with reverse shell, credential harvesting, file exfiltration, and persistent backdoor injection capabilities.
Checkmarx cybersecurity researchers have uncovered a new cluster of seven malicious npm packages, dubbed ViteVenom, that are specifically targeting developers using the Vite frontend tooling ecosystem.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
A self-executing function takes a 653-character scrambled string and seed 4606094, applies a deterministic character-swap algorithm, and produces an array of 63 strings... Every sensitive value — URLs, blockchain addresses, XOR keys — is accessed by index lookup rather than written in plain text.
ViteVenom uses scoped package names such as @vite-pro/vite-ui and @vitets/vite-ts that mimic the legitimate @vitejs/* namespace.
If the Tron-based payload retrieval method fails, the malware uses Aptos as a backup.
The loader does not simply download a payload from one domain. It queries a Tron transaction, decodes transaction data to obtain a Binance Smart Chain transaction hash, extracts encrypted payload data from the BSC transaction, and decrypts it with a hard-coded key. If the Tron route fails, the malware can use Aptos as a backup path.
using an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only in a referenced report title as another malware set associated with the broader campaign.
A cluster of malicious npm packages targeting the Vite ecosystem that uses the same blockchain-based C2 design to deliver a RAT with reverse shell, credential theft, file exfiltration, and persistence capabilities.
A malicious npm package cluster targeting Vite ecosystem developers. It delivers a remote access trojan capable of reverse shell execution, credential harvesting, file exfiltration, and persistent backdoor injection, with malicious code triggered at import time and blockchain-based C2 retrieval for resilience and evasion.
Named npm supply-chain malware targeting the Vite ecosystem.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.