Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
A sophisticated software supply chain attack, dubbed ViteVenom, is leveraging a blockchain-based command-and-control (C2) infrastructure to deliver a remote access trojan (RAT) targeting Vite frontend developers. The attack, attributed to the threat actor SuccessKey, utilizes seven malicious npm packages disguised as legitimate Vite libraries, making it exceptionally difficult to detect and remove. The campaign employs a multi-layered approach, utilizing blockchain infrastructure across Tron, Aptos, and Binance Smart Chain to maintain operational resilience.
A complex software supply chain attack, known as ViteVenom, is targeting Vite frontend developers through a series of malicious npm packages. Cybersecurity researchers at Checkmarx discovered this campaign, which is linked to a threat actor named SuccessKey, and utilizes a blockchain-based command-and-control (C2) infrastructure. The attack leverages seven packages masquerading as legitimate Vite libraries, including `@uw010010/vite-tree`, `@vite-tab/tab`, `@vite-ln/build-ts`, `@vite-mcp/vite-type`, `@vite-pro/vite-ui`, `@vitets/vite-ts`, and `@vite-ts/vite-ui`.
Unlike previous campaigns like ChainVeil, ViteVenom employs scoped package names to appear as part of the official `@vitejs/*` namespace, increasing its legitimacy and making it harder to identify. The core of the attack involves a multi-stage process: first, the attacker queries the Tron blockchain for the latest transaction from their wallet. This transaction data is then decoded to retrieve a BSC transaction hash, which is used to query the BSC transaction for the encrypted payload.
This payload is decrypted using a hard-coded key, and if Tron retrieval fails, the attacker falls back to using Aptos as a backup. The payload itself then queries the blockchain to retrieve the C2 configuration and a next-stage loader responsible for launching the RAT. A fallback mechanism also allows the RAT to be fetched directly from a C2 server over HTTP, bypassing blockchain infrastructure entirely.
Users who have installed the packages are strongly advised to remove them immediately, audit their dependencies, rotate all credentials, and scan for unauthorized modifications to files like `.bashrc`, `.zshrc`, and `.profile`. The attack’s compartmentalized approach – utilizing different package names, maintainer accounts, and wallet addresses – is designed to minimize detection and limit exposure. The use of blockchain infrastructure significantly increases the difficulty of taking down the C2 infrastructure.