New ViteVenom Malware Targets Developers with Blockchain C2 RAT

• •ViteVenom targets the Vite frontend ecosystem with seven malicious npm packages.
• •The malware uses blockchain technology for its command-and-control infrastructure.
• •Developers are urged to remove affected packages and secure their systems immediately.

Checkmarx researchers have identified a cluster of seven malicious npm packages named ViteVenom, targeting the Vite frontend ecosystem. The campaign, attributed to the threat actor SuccessKey, builds on tactics from the ChainVeil attack. ViteVenom uses a blockchain-based command-and-control (C2) infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). This RAT can execute a reverse shell, harvest credentials, exfiltrate files, and inject persistent backdoors. The malware employs scoped package names to impersonate legitimate Vite packages, executing malicious code at import time to evade detection. Users are advised to remove affected packages, audit dependencies, and rotate credentials. The attack highlights the ongoing threat of software supply chain vulnerabilities.