ViteVenom: Seven npm Packages Use Blockchain as Unstoppable C2

The ViteVenom campaign distributes malware via npm using Tron, Aptos, and Binance Smart Chain as command-and-control infrastructure. Attribution to PolinRider points to a North Korea-linked APT.

On July 17, 2026, Checkmarx disclosed the ViteVenom campaign: seven malicious npm packages that impersonate the Vite ecosystem and deliver a RAT through a command-and-control infrastructure distributed across three public blockchains. The packages were published between June 29 and July 3, 2026, but malicious activity dates back to February 27, 2026, the activation date of the cryptocurrency wallets linked to the operation. The case marks a qualitative leap in supply chain attacks: the C2 is no longer a seizable domain, but an immutable ledger.

Key Takeaways

Seven malicious npm packages impersonate the @vitejs/* namespace with scoped package names, a more sophisticated technique than the non-scoped typosquatting used by the previous ChainVeil campaign.
The C2 infrastructure spans four tiers across three blockchains — Tron primary, Aptos fallback, Binance Smart Chain for the payload — making takedown technically impractical for authorities.
Malicious code executes at import time, not at installation, evading endpoint security controls designed to monitor package manager runtime behavior.
Checkmarx attributes the operation to threat actor PolinRider, assessed as linked to North Korean hackers; Socket identified 108 unique packages and browser extensions tied to the same actor across npm, Packagist, Go, and Google Chrome.

From ChainVeil to ViteVenom: The Evolution of npm Typosquatting

ViteVenom represents an expansion of the ChainVeil campaign, previously observed by Checkmarx. The substantive difference lies in the deception technique: where ChainVeil used mangled non-scoped names like rate-limit-flexible, ViteVenom employs scoped package names to mimic the official @vitejs/* namespace. This approach exploits developers' familiarity with the Vite ecosystem's naming convention, one of the most widely used frontend JavaScript build tools.

The compartmentalization between the two campaigns is methodical. According to Checkmarx: "The superficial differences — different package names, different maintainer accounts, different Tier-1 wallets, different malicious file paths — are consistent with how a single operator would compartmentalize multiple distributions to limit exposure." The dossier does not specify whether the seven packages remain available on the npm registry or have been removed.

The Four-Tier C2 Architecture: When Blockchain Replaces DNS

The innovative core of ViteVenom is the payload retrieval mechanism. Instead of contacting a seizable C2 domain, the malware queries the Tron blockchain as the first tier. Transaction data, once decoded and reversed, yields the hash of a transaction on the Binance Smart Chain. From this second transaction the agent extracts the encrypted payload from the input field, then decrypts it with a hard-coded key. If the Tron channel fails, the malware falls back to Aptos. An additional HTTP fallback mechanism retrieves the RAT directly from C2 servers, bypassing the blockchain chain entirely.

"The attacker stores payload pointers as transaction data on public blockchains rather than on seizable domains, making the infrastructure practically impossible to take down" — Pavan Gudimalla, Checkmarx researcher

The delivered RAT has four documented capabilities: reverse shell, credential theft, file exfiltration, and persistent backdoor injection. Deferred execution at import — not during npm install — is a deliberate design choice: many endpoint security solutions monitor installation process behavior, not code execution inside the host application runtime.

Attribution to PolinRider and the Nation-State Context

Checkmarx links ViteVenom to threat actor PolinRider through three overlapping elements: shared TRON wallets, identical Aptos fallback address, and common XOR decryption keys with the ChainVeil campaign. The source specifies that PolinRider is "assessed as linked to North Korean hackers," without however declaring absolute certainty of state attribution. Jenn Gile, co-founder of OpenSourceMalware, confirmed: "It's PolinRider, operating directly against the npm and Vite ecosystems."

The actor's scope is significant: Socket identified 108 unique packages and browser extensions linked to PolinRider, distributed across four different platforms (npm, Packagist, Go, Google Chrome). This pattern indicates a long-term supply chain operation, not an opportunistic or short-lived action. The dossier does not specify the number of installations or concrete victims of the ViteVenom campaign.

Why It Matters

The brief does not document specific remedial measures indicated by Checkmarx or other sources. The source does not specify whether the packages have been removed from the npm registry, nor does it provide exact names of the seven malicious artifacts or hashes of the wallets involved.

The strategic novelty of ViteVenom lies in the structural resilience of its C2. Traditional response tools — DNS takedowns, domain seizures, ISP blacklists — operate on a centralized network architecture. A public blockchain is, by design, resistant to these actions. There is no registrar to contact, no hosting provider to disable. Once confirmed, the transaction is immutable. The HTTP fallback, however, leaves open a conventional attack surface that existing defenses could intercept, though the dossier does not specify URLs or indicators of compromise for this channel.

Import-time execution represents another shift in the risk perimeter. CI/CD pipelines, development environments, and build servers constantly execute import or require of dependencies. Installation time is only one phase of the lifecycle; the moment of actual execution is multiple and distributed. The source does not document which static or dynamic controls can detect the malicious behavior before import.

Finally, attribution to a North Korea-assessed APT raises the risk level for organizations with JavaScript dependencies. Nation-state supply chain attacks typically aim for long-term persistence and access to strategically valuable networks, not immediate profit via ransomware. The ViteVenom campaign, active for at least five months (February–July 2026), is consistent with this timeline.

Frequently Asked Questions

How exactly does blockchain-based payload retrieval work?

The malware queries the Tron blockchain, decodes and reverses transaction data to obtain a BSC transaction hash, then extracts the encrypted payload from the input field of the BSC transaction and decrypts it with a hard-coded key. The Aptos fallback follows the same principle on a different chain. The source does not specify the decryption key or exact wallet addresses.

Is the attribution to North Korea certain?

No. Checkmarx assesses PolinRider as "linked to North Korean hackers," but does not declare absolute confirmation. The assessment is based on infrastructure overlaps (wallets, keys) with previous campaigns, not on direct evidence of state attribution.

Is there a CVE for this campaign?

The dossier does not mention CVEs assigned to ViteVenom. The campaign is a supply chain attack distributed via malicious npm packages, not a product vulnerability in the official Vite codebase.

Sources

Information is based on cited sources and current as of publication.

Sources

Sources and references