ViteVenom: six npm packages targeting Vite developers use blockchain C2 to deliver a RAT

Checkmarx has published analysis of ViteVenom, a campaign targeting developers using the Vite frontend build tool. Seven npm packages published between June 29 and July 14 impersonate the @vitejs namespace and deliver a remote access trojan via a multi-tier blockchain command-and-control infrastructure spanning Tron, Aptos, and Binance Smart Chain. Checkmarx attributes the campaign to a threat actor named SuccessKey and identifies ViteVenom as a sequel to ChainVeil, an earlier campaign using the same blockchain C2 architecture against Tailwind, Sass, and ORM developers.

Six of the seven packages return risk_state: critical with supply_chain.compromised: true in Attestd's production API. The compromised_at timestamps in the ledger run from July 8 to July 14, predating Checkmarx's July 17 publication.

The blockchain C2 architecture#

The technical innovation in this campaign is the command-and-control infrastructure. Rather than using domains that can be seized or IP addresses that can be blocked, the payload delivery chain runs through public blockchain transactions.

The execution sequence per Checkmarx's analysis: the implant queries a Tron wallet for the latest transaction, decodes the transaction data field to obtain a BSC transaction hash, queries that BSC transaction to extract an encrypted payload, and decrypts it using a hardcoded key. If the Tron chain query fails, Aptos serves as a backup. A direct HTTP fallback to a C2 server exists if both blockchain paths fail.

The practical implication is that standard network-based defenses cannot block this C2 channel by taking down a domain or an IP. The blockchain infrastructure is public, distributed, and outside any single party's ability to disable.

Like the prior AsyncAPI and PhantomSync campaigns, the malicious code does not execute at install time. It fires when the infected module is imported during normal application use. Running npm install with --ignore-scripts does not stop it.

What Attestd returns#

curl "https://api.attestd.io/v1/check?product=%40vite-ts%2Fvite-ui&version=6.44.1" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "@vite-ts/vite-ui",
  "version": "6.44.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in @vite-ts/vite-ui (npm)",
    "compromised_at": "2026-07-14T03:33:32Z"
  },
  "supply_chain_monitored": true
}

No CVEs. risk_state: critical from the supply chain signal alone.

The six confirmed packages#

All six return risk_state: critical with supply_chain.compromised: true.

The seventh package named by Checkmarx, @vite-ln/build-ts, has been pulled from the npm registry. The only version currently available is a 0.0.1-security placeholder stub, which returns risk_state: none with supply_chain.compromised: false. No compromised version is demonstrable via the API because no compromised version remains on the registry.

The scoped namespace impersonation pattern#

ViteVenom uses scoped package names designed to resemble @vitejs, the official Vite organisation scope. @vite-ts/vite-ui, @vite-pro/vite-ui, @vitets/vite-ts and similar names exploit the visual similarity between @vitejs and @vite-ts or @vitets in a dependency list or lockfile. A developer doing a quick review might not catch the difference.

Checkmarx notes this is a deliberate evolution from ChainVeil's unscoped typosquats. Scoped packages with near-matching scope names are harder to detect by visual inspection than unscoped names with character substitutions.

Attribution and credit#

ViteVenom is named and attributed by Checkmarx. The full technical analysis including the blockchain C2 architecture detail, the SuccessKey actor identification, and the connection to ChainVeil is Checkmarx's work.

Full analysis: ViteVenom: Sequel to ChainVeil npm Malware Targets Vite Ecosystem — Checkmarx, July 17, 2026.

Attestd's contribution is the supply chain monitoring coverage and the detection timestamps. The compromised_at dates in the ledger run 3 to 9 days before Checkmarx's publication date. The packages were flagged as part of the automated OSV sweep and surfaced in the research pipeline before the campaign name or attribution existed.

Coverage#

Six of the seven ViteVenom packages named by Checkmarx are covered and return risk_state: critical with supply_chain.compromised: true. The seventh, @vite-ln/build-ts, is covered but has no demonstrable compromised version remaining on the registry.

If any of these packages appear in a dependency tree, remove them immediately. Checkmarx recommends auditing dependencies, rotating all credentials, and checking .bashrc, .zshrc, and .profile for unauthorized modifications.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. Machine speed thesis: attestd.io/thesis.