# Malicious npm Packages Exploit Blockchain to Deploy RAT in Vite Ecosystem

*Published July 20, 2026*
*Source: [https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html](https://thehackernews.com/2026/07/seven-malicious-vite-npm-packages-use.html)*

## Executive Summary

Seven malicious npm packages have been identified targeting the Vite ecosystem, deploying a remote access trojan via a sophisticated blockchain-based infrastructure. This campaign, known as ViteVenom, poses significant risks to developer supply chains and shows links to North Korean threat actors.

## Article

A cluster of seven malicious npm packages has been discovered targeting the Vite frontend tooling ecosystem, marking a new phase in software supply chain attacks. This campaign, identified as ViteVenom by Checkmarx researchers, builds on the ChainVeil attack by utilizing a sophisticated four-layer blockchain-based command-and-control infrastructure. This infrastructure spans Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan capable of reverse shell operations, credential theft, and file exfiltration.

The campaign has been linked to a threat actor named SuccessKey, with malicious activity tracked back to early 2026. These npm packages mimic legitimate libraries used in Vite, a JavaScript build tool, by adopting scoped package names that appear to belong to the official Vite namespace. This tactic enhances their chances of being inadvertently installed by developers.

Unlike previous attacks, the malicious code in these packages activates during the import process rather than installation, which helps evade traditional endpoint security measures. By storing payload pointers on public blockchains instead of traditional domains, the attackers make it nearly impossible to dismantle their command-and-control setup. If the primary Tron-based method fails, Aptos serves as a backup, and a direct HTTP retrieval method acts as a further fallback.

Developers who have installed these packages are urged to remove them immediately, conduct a thorough audit of their dependencies, and rotate all credentials to mitigate potential damage. This attack shares characteristics with another threat cluster known as PolinRider, which has been linked to North Korean hackers. Recent findings by OpenSourceMalware highlight overlaps in blockchain wallet addresses and decryption keys, confirming the connection to PolinRider activities.