Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have identified seven malicious npm packages targeting the Vite frontend tooling ecosystem in a software supply chain attack. The campaign, named ViteVenom by Checkmarx, extends the ChainVeil operation and employs a complex four-tier blockchain-based command-and-control system to deliver remote access trojans (RATs).

What happened

Researchers discovered a cluster of seven malicious npm packages aimed at compromising the Vite frontend tooling ecosystem through a software supply chain attack. This campaign, designated ViteVenom by the cybersecurity firm Checkmarx, represents an evolution of the ChainVeil threat group’s activity. The attack uses a sophisticated four-tier command-and-control infrastructure based on the Tron blockchain network to coordinate the delivery of malicious remote access trojans (RATs). This infrastructure is considered unprecedented in its design for such malware campaigns.

Why it matters

Supply chain attacks on widely used development tools like Vite pose significant risks to software projects and their end users, as compromised packages can propagate malware to many downstream applications. The use of blockchain technology for command-and-control purposes introduces new challenges for defenders, as it provides stealth, resilience, and decentralization to the threat actor’s infrastructure. Understanding such novel tactics is crucial for anticipating and mitigating emerging supply chain threats.

What security teams should do

Security teams, particularly those involved in frontend development using npm and Vite, should carefully review their dependency chains for the presence of the identified malicious packages. Monitoring package repositories and employing automated tools to detect unusual or untrusted dependencies can help in early detection. Additionally, maintaining strict access controls and verifying packages before integration is advisable to reduce the risk of supply chain compromises.

Key technical details

The ViteVenom campaign leverages seven malicious npm packages targeting Vite, a popular frontend tooling ecosystem. Unlike typical command-and-control setups, this operation employs a four-tier blockchain-based C2 infrastructure utilizing the Tron blockchain network to coordinate RAT payload delivery. This multi-layer approach is notable for its complexity and use of decentralized blockchain mechanisms to evade detection and takedown efforts.

Affected organizations/products

The attack specifically targets the Vite frontend tooling ecosystem through malicious npm packages. No additional affected organizations or products have been publicly identified beyond this scope.

Source attribution

https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html