{"slug": "vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats", "title": "ViteVenom: 7 Fake npm Packages Use Blockchain to Deliver RATs", "summary": "Seven malicious npm packages impersonating Vite's official namespace were published between June 29 and July 3, delivering a remote access trojan via blockchain-based command-and-control infrastructure on Tron, Binance Smart Chain, and Aptos. The campaign, dubbed ViteVenom by Checkmarx and attributed to threat actor SuccessKey, collected around 2,600 downloads before removal, and the blockchain C2 makes the attack infrastructure nearly impossible to take down.", "body_md": "Seven malicious npm packages impersonating Vite’s official `@vitejs/*`\n\nnamespace were published to npm between June 29 and July 3, and they’ve been delivering a remote access trojan through an infrastructure nobody can shut down: the Tron, Binance Smart Chain, and Aptos blockchains. Checkmarx named the campaign ViteVenom — an expansion of an earlier operation called ChainVeil, attributed to a threat actor dubbed SuccessKey. The packages collected around 2,600 downloads before removal. If your team added any `@vite-*`\n\nscoped package over the last three weeks, treat it as compromised until proven otherwise.\n\n## The Seven Packages\n\nAll seven impersonate the `@vitejs/*`\n\nnamespace — the same scope used by the official Vite organization for packages like `@vitejs/plugin-react`\n\nand `@vitejs/plugin-vue`\n\n. The fakes:\n\n`@uw010010/vite-tree`\n\n(1,070 downloads)`@vite-tab/tab`\n\n(289 downloads)`@vite-ln/build-ts`\n\n(252 downloads)`@vite-mcp/vite-type`\n\n(239 downloads)`@vite-pro/vite-ui`\n\n(200 downloads)`@vitets/vite-ts`\n\n(194 downloads)`@vite-ts/vite-ui`\n\n(176 downloads)\n\nNone of these come from the official Vite team. The real `@vitejs`\n\npackages are listed at [npmjs.com/org/vitejs](https://www.npmjs.com/org/vitejs). Anything using a variation of the pattern — different prefix, numeric suffix, duplicated scope — is a red flag.\n\n## Why This Attack Is Different: Blockchain C2\n\nMost supply chain attacks use conventional command-and-control servers. Security teams take down the C2 domain, the malware goes silent, the campaign ends. ViteVenom doesn’t work that way.\n\nThe malware retrieves its instructions from blockchain transactions — specifically a four-tier infrastructure: the malware first queries the attacker’s Tron wallet for the latest transactions, decodes those memo fields to get Binance Smart Chain transaction hashes, retrieves the encrypted payload from the BSC transaction input data, and decrypts it locally. If Tron is unavailable, it falls back to Aptos. If the blockchain approach fails entirely, it falls back to a direct HTTP request to a C2 server.\n\nThe point that matters: blockchain transactions are immutable. There is no domain to seize, no registrar to call, no server to null-route. As Checkmarx researcher Pavan Gudimalla put it: *“The attacker stores payload pointers as transaction data on public blockchains rather than on domain names that can be seized, making the infrastructure nearly impossible to take down.”* Even with every package removed from npm, the attack infrastructure remains fully operational.\n\nThis is the second confirmed blockchain C2 technique in a major npm supply chain attack this year. The first used Internet Computer Protocol canisters in a compromised Trivy binary. The technique is spreading — and it fundamentally changes how difficult these campaigns are to shut down.\n\n## The Detection Gap: Import Time, Not Install Time\n\nHere’s why your existing tooling probably didn’t catch this. The malicious code doesn’t run when you run `npm install`\n\n. It waits until the module is *imported* in your application.\n\n`npm audit`\n\n, pre-install hook scanners, and most CI/CD security steps execute during the install phase. ViteVenom deliberately sidesteps this. By the time the payload triggers, your install-time tools are long done and their logs are clean. You’d need runtime analysis or deep static analysis of the imported module to catch it — neither of which is standard practice in most frontend pipelines.\n\n## What the RAT Does\n\nIf the payload executes successfully, the attacker gains:\n\n- A reverse shell — full command execution on the developer’s machine\n- Credential harvesting — API keys, SSH keys, browser-stored passwords,\n`.env`\n\nfiles - File exfiltration — source code and configuration sent to the attacker\n- Persistent backdoor — modifications to\n`.bashrc`\n\n,`.zshrc`\n\n, and`.profile`\n\nDeveloper machines are a richer target than production servers in some ways: they hold secrets for multiple environments, have broad access to internal tools, and typically run with fewer security controls than production infrastructure.\n\n## Why Vite?\n\nVite now sees around [84 million npm downloads per week](https://2025.stateofjs.com/en-US/libraries/build-tools/). It’s the default build tool for Vue, Svelte, React (since Create React App was deprecated), and Astro. Cloudflare acquired VoidZero — the company behind Vite — in June 2026, raising the project’s profile further.\n\nAll of this makes the `@vitejs`\n\nnamespace a premium impersonation target. Developers install Vite plugins routinely; an unfamiliar `@vite-*`\n\nscoped package doesn’t immediately raise alarms, especially when it appears in an AI coding agent suggestion or a copied snippet from a tutorial.\n\n## What to Do Right Now\n\nFirst, audit your dependencies for the flagged packages:\n\n```\nnpm ls | grep @vite\n# or scan directly\ngrep -r \"@vite-\\|@vitets\\|@uw010010\" package.json package-lock.json\n```\n\nIf any match appears: remove the package immediately, rotate all credentials accessible from that machine (API keys, tokens, SSH keys), and check for persistence:\n\n```\ngrep -E \"vite-tree|vite-tab|vite-mcp|vite-pro|vitets\" ~/.bashrc ~/.zshrc ~/.profile\n```\n\nGoing forward, consider adding [Socket](https://socket.dev) to your npm workflow — it provides supply chain risk analysis beyond what `npm audit`\n\ncovers, including import-time behavior detection. The [full Checkmarx report via The Hacker News](https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html) includes indicators of compromise you can run against your logs.\n\nThe broader lesson from ViteVenom: `npm audit`\n\nalone is no longer sufficient. Supply chain attacks have evolved past install-time execution and are now running C2 on infrastructure that’s immune to domain seizure. Any unknown scoped package deserves verification against the official org page — not just a name match — before installation.", "url": "https://wpnews.pro/news/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats", "canonical_source": "https://byteiota.com/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats/", "published_at": "2026-07-19 08:20:57+00:00", "updated_at": "2026-07-19 08:30:54.376112+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools"], "entities": ["Checkmarx", "SuccessKey", "Vite", "npm", "Tron", "Binance Smart Chain", "Aptos", "Pavan Gudimalla"], "alternates": {"html": "https://wpnews.pro/news/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats", "markdown": "https://wpnews.pro/news/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats.md", "text": "https://wpnews.pro/news/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats.txt", "jsonld": "https://wpnews.pro/news/vitevenom-7-fake-npm-packages-use-blockchain-to-deliver-rats.jsonld"}}