As outlined in The Hacker News, Checkmarx cybersecurity researchers have uncovered a new cluster of seven malicious npm packages, dubbed ViteVenom, that are specifically targeting developers using the Vite frontend tooling ecosystem. This represents an expansion of software supply chain attacks.
The ViteVenom campaign, attributed to the threat actor SuccessKey, builds upon the tactics seen in the earlier ChainVeil attack. It utilizes a sophisticated, multi-tier blockchain-based command-and-control infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). This RAT is capable of executing a reverse shell, harvesting credentials, exfiltrating files, and injecting persistent backdoors. Unlike attacks, ViteVenom employs scoped package names to impersonate the "@vitejs/*" namespace, aiming for increased legitimacy.
The malware's malicious code executes at import time, not install time, to evade endpoint security detections. It queries blockchains to retrieve encrypted payloads, making the C2 infrastructure extremely difficult to dismantle. Users who may have installed these packages are strongly advised to remove them immediately, audit their dependencies, rotate all credentials, and check for unauthorized system modifications.
Source: The Hacker News
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
