Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

1. Executive summary

Checkmarx has identified seven malicious npm packages targeting the Vite JavaScript build tool ecosystem in a supply-chain campaign codenamed "ViteVenom." The packages use scoped typosquat names impersonating the legitimate @vitejs/* namespace and deliver a RAT via a four-tier blockchain-based C2 infrastructure spanning Tron, Aptos, and Binance Smart Chain (BSC). The malware executes at import time (not install time), limiting endpoint detections, and provides the threat actor "SuccessKey" with a reverse shell, credential harvesting, file exfiltration, and persistent backdoor capabilities. EMEA financial services development teams using Vite and npm are directly exposed if developers have installed any of the identified packages between June 29 and July 3, 2026.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk — general principles	Malicious code introduced via npm packages (third-party ICT services/components) into the software supply chain	Clients must apply third-party risk controls to open-source package consumption — dependency auditing, package allow-listing, and integrity verification for development pipelines.
NIS2 Art. 21(2)(d): supply chain security measures	Supply-chain compromise via typosquatted npm packages delivering a RAT with credential harvesting and file exfiltration	In-scope entities must review and tighten supply-chain security measures around package management, dependency review processes, and developer endpoint monitoring.
DORA Art. 17: ICT-related incident management process	RAT deployment capable of credential harvesting, file exfiltration, and persistent backdoor injection constitutes an ICT-related incident if packages were installed in production-adjacent environments	Clients with confirmed installations must trigger incident management processes including containment, credential rotation, and forensic assessment of developer machines and CI/CD systems.

3. Technical analysis & attack chain

Attribution caveat: The threat actor "SuccessKey" is named by Checkmarx (single-sourced; verify before enforcement). No MITRE ATT&CK profile is available in the verified reference data for this actor; attribution is unconfirmed.

Confirmed attack chain

Initial access — typosquatted scoped npm packages: Seven packages were published to npm between June 29 and July 3, 2026, using scoped names designed to impersonate the legitimate @vitejs/* Vite namespace: - @uw010010/vite-tree (1,070 downloads) - @vite-tab/tab (289 downloads) - @vite-ln/build-ts (252 downloads) - @vite-mcp/vite-type (239 downloads) - @vite-pro/vite-ui (200 downloads) - @vitets/vite-ts (194 downloads) - @vite-ts/vite-ui (176 downloads)
Execution at import time (not install time): The malicious code does not execute during npm install but at module import time, reducing the likelihood of endpoint security detection during the install phase.
Loader contacts blockchain C2 — Tier 1 (Tron): The malware queries the Tron blockchain for the latest transaction from the attacker's wallet address.
Tier 2 (BSC pointer extraction): The transaction data field is decoded and reversed to obtain a Binance Smart Chain (BSC) transaction hash.
Tier 3 (BSC payload retrieval): The malware queries the BSC transaction and extracts an encrypted payload from the transaction's input field.
Payload decryption: The payload is decrypted using a hard-coded key embedded in the malicious package code.
Fallback — Aptos: If the Tron-based payload retrieval method fails, the malware uses Aptos as a backup blockchain C2 channel.
Tier 4 (C2 configuration and RAT delivery): The decrypted payload queries the blockchain to retrieve C2 configuration and a next-stage loader responsible for launching the RAT.
HTTP fallback: A separate fallback mechanism fetches the RAT directly from the C2 server over HTTP, bypassing the blockchain infrastructure entirely.
RAT capabilities: The delivered payload provides:
- Reverse shell
- Credential harvesting
- File exfiltration
- Persistent backdoor injection
Persistence mechanism: The malware modifies shell configuration files — .bashrc, .zshrc, and .profile — to establish persistence on developer machines.

Infrastructure linkage: ViteVenom shares tier-2 infrastructure with the earlier "ChainVeil" campaign — specifically, the same Tron wallet address and Aptos account address, both pointing to the same BSC transaction leading to the malware. This shared infrastructure is the primary link between the two campaigns. The surface-level differences (package names, maintainer accounts, tier-1 wallets, malicious file paths) are consistent with a single operator compartmentalising multiple distribution tracks.

Timeline: Cryptocurrency wallets linked to ViteVenom were first activated on February 27, 2026, indicating the campaign's infrastructure was operational months before the npm packages were published.

Single-sourced confidence caveat: All technical detail in this section derives from the Checkmarx analysis as reported by The Hacker News. No independent corroboration is available. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

Identify and remove malicious packages: Search all development machines, CI/CD runners, and build artefacts for the seven identified package names. Remove immediately: npm ls @uw010010/vite-tree @vite-tab/tab @vite-ln/build-ts @vite-mcp/vite-type @vite-pro/vite-ui @vitets/vite-ts @vite-ts/vite-ui
Isolate affected developer machines: Any machine with a confirmed installation should be isolated from corporate networks and source-code repositories pending forensic review.
Rotate all credentials: Rotate credentials that may have been accessible from affected machines — including SSH keys, API tokens, cloud access keys, npm publish tokens, Git credentials, and CI/CD secrets. Assume the RAT's credential harvesting capability has been exercised.
Check persistence: Inspect .bashrc, .zshrc, and .profile on all developer machines and CI/CD containers for unauthorised modifications or injected commands.

P2 — Within 72 hours

Audit dependencies: Run full dependency tree audits across all repositories to identify any transitive dependencies on the seven malicious packages.
Review source code for unauthorised modifications: If the RAT gained access to source repositories, review recent commits and branches for unauthorised changes, injected credentials, or modified build configurations.
Block known C2 pathways at network level: Implement egress filtering for blockchain API endpoints used by the malware (Tron RPC, BSC RPC, Aptos RPC) from developer and build environments where blockchain queries are not expected. This will not block the HTTP fallback path — monitor for suspicious outbound HTTP connections from build processes.
Review CI/CD pipeline logs: Examine build logs for evidence of import-time execution anomalies, unexpected network connections during builds, or unexpected child processes spawned by Node.js/Vite processes.

P3 — Within 7 days

Implement package allow-listing: Configure npm registries or proxy layers (e.g., Artifactory, Nexus) to enforce package allow-listing and block installation of unrecognised scoped packages.
Enable npm audit and SCA scanning: Integrate software composition analysis (SCA) tooling into CI/CD pipelines to flag typosquatted and known-malicious packages at PR/merge time.
Developer awareness: Brief development teams on the typosquat technique, the legitimate @vitejs/* namespace, and the requirement to verify package names and download counts before installation.
Review package.json and lockfiles: Ensure all package.json and package-lock.json / pnpm-lock.yaml files pin to verified package versions and do not reference any of the seven malicious packages.

5. Indicators of compromise

No atomic indicators (wallet addresses, C2 domains, IPs, file hashes) are present in the source material. The source identifies package names and behavioural patterns but does not publish blockchain wallet addresses, C2 URLs, file hashes, or specific file paths beyond the shell configuration files.

Behavioural indicators

Behaviour	Where to observe	Confidence
Import-time network connection to Tron blockchain RPC endpoints	Egress network logs, EDR network telemetry from Node.js processes	High (single-sourced)
Import-time network connection to BSC RPC endpoints	Egress network logs, EDR network telemetry from Node.js processes	High (single-sourced)
Import-time network connection to Aptos blockchain RPC endpoints	Egress network logs, EDR network telemetry from Node.js processes	Medium (fallback path)
Unauthorised modifications to `.bashrc`, `.zshrc`, `.profile`	Endpoint EDR, file integrity monitoring, developer workstations	High (single-sourced)
Outbound HTTP connection from Node.js/Vite build process to non-standard server (HTTP fallback C2)	Egress proxy logs, EDR network telemetry	Medium (single-sourced)
npm install of scoped packages matching `@vite-` or `@uw010010/vite-tree` patterns that are NOT in the legitimate `@vitejs/` namespace	npm registry logs, package manager logs, SCA tooling	High (single-sourced)

6. Detection

The sources provide distinctive package names and behavioural patterns sufficient for detection rules.

rule ViteVenom_NPM_Malicious_Packages {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html"
    description = "Detects malicious Vite typosquat npm packages from ViteVenom campaign"
  strings:
    $pkg1 = "@uw010010/vite-tree" nocase
    $pkg2 = "@vite-tab/tab" nocase
    $pkg3 = "@vite-ln/build-ts" nocase
    $pkg4 = "@vite-mcp/vite-type" nocase
    $pkg5 = "@vite-pro/vite-ui" nocase
    $pkg6 = "@vitets/vite-ts" nocase
    $pkg7 = "@vite-ts/vite-ui" nocase
  condition:
    any of ($pkg*)
}

title: Detect Installation of Malicious Vite Typosquat npm Packages
id: 7a3c1f2e-2026-0717-3350-000000000001
status: experimental
description: Detects npm install commands referencing any of the seven malicious Vite typosquat packages identified in the ViteVenom campaign
references:

  - https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html
author: Adverse Trace
date: 2026/07/17
logsource:
  product: linux
  category: process_creation
detection:
  selection_pkg:
    CommandLine|contains:

      - '@uw010010/vite-tree'
      - '@vite-tab/tab'
      - '@vite-ln/build-ts'
      - '@vite-mcp/vite-type'
      - '@vite-pro/vite-ui'
      - '@vitets/vite-ts'
      - '@vite-ts/vite-ui'
  selection_npm:
    Image|endswith:

      - '/npm'
      - '/yarn'
      - '/pnpm'
  condition: selection_pkg
falsepositives:

  - Unlikely — these are typosquatted package names with no legitimate use
level: critical

title: Detect Unauthorised Modification of Shell RC Files by Node.js Process
id: 7a3c1f2e-2026-0717-3350-000000000002
status: experimental
description: Detects modifications to .bashrc, .zshrc, or .profile by Node.js processes, consistent with ViteVenom RAT persistence
references:

  - https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html
author: Adverse Trace
date: 2026/07/17
logsource:
  product: linux
  category: file_event
detection:
  selection_target:
    TargetFilename|endswith:

      - '.bashrc'
      - '.zshrc'
      - '.profile'
  selection_process:
    Image|contains:

      - 'node'
      - 'npm'
  condition: selection_target and selection_process
falsepositives:

  - Legitimate development tooling that modifies shell configuration (rare)
level: high

7. Sources

The Hacker News, "Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT," https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html, 2026-07-17
Checkmarx (via The Hacker News reporting), researcher Pavan Gudimalla, original analysis published June 2026

8. Adverse Trace position

This is a high-severity supply-chain compromise targeting the Vite/npm ecosystem with a capable RAT delivered through resilient blockchain C2 infrastructure that is extremely difficult to take down. The import-time execution model and blockchain-based payload retrieval are specifically designed to evade endpoint detections, making post-installation discovery harder. EMEA financial services with modern JavaScript/frontend stacks should treat this as an active threat: the packages collectively achieved over 2,400 downloads, and any developer machine or CI/CD pipeline that imported them should be considered compromised until proven otherwise. The attribution to "SuccessKey" and the link to the earlier "ChainVeil" campaign are single-sourced from Checkmarx — we will monitor for independent corroboration. We will track for publication of blockchain wallet addresses and C2 infrastructure indicators as they become available and update this advisory accordingly.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.