Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Back Thehackernews

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Thehackernews •[email protected] (The Hacker News) • July 17, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New ViteVenom Malware Targets Developers with Blockchain C2 RAT Checkmarx researchers have identified a cluster of seven malicious npm packages named ViteVenom, targeting the Vite frontend ecosystem. The campaign, attributed to the threat actor SuccessKey, builds on tactics from the ChainVeil attack. ViteVenom uses a blockchain-based command-and-control (C2) infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). This RAT can execute a reverse shell, harvest credentials, exfiltrate files, and inject persistent backdoors. The malware employs scoped package names to impersonate legitimate Vite packages, executing malicious code at import time to evade detection. Users are advised to remove affected packages, audit dependencies, and rotate credentials. The attack highlights the ongoing threat of software supply chain vulnerabilities. 3 sources 69

Extracted Entities

Attack Types (2)

Supply Chain Attack Trojan

MITRE ATT&CK (2)

T1071 - Application Layer Protocol T1195 - Supply Chain Compromise

Platforms (1)

Tools (1)