ViteVenom npm Supply Chain Campaign (ChainVeil Blockchain C2)
First seen Jul 18, 2026 · Updated Jul 18, 2026
Researchers at Checkmarx identified seven malicious npm packages targeting the Vite frontend tooling ecosystem, codenamed ViteVenom, which deliver a remote access trojan (RAT). The campaign extends the previously observed ChainVeil operation, leveraging a four-tier blockchain-based command-and-control infrastructure spanning multiple chains including Tron to evade takedown and detection.
Technical Analysis
The ViteVenom packages masquerade as legitimate Vite tooling dependencies and, once installed, execute post-install scripts that fetch a RAT payload. The C2 infrastructure uses a novel four-tier blockchain-based architecture (leveraging Tron and likely other chains) to store and resolve C2 addresses, making the infrastructure resilient to domain/IP takedown and harder to block via traditional network defenses. This technique mirrors prior blockchain-based dead-drop resolver patterns seen in npm/PyPI supply chain attacks, but with added redundancy across multiple chains. Developers and CI/CD pipelines that install these packages via automated dependency resolution are at risk of silent RAT deployment, credential theft, and lateral movement within build environments. Any AI agent or coding-assistant system that autonomously installs npm dependencies, runs build pipelines, or incorporates Vite-based frontend scaffolding into generated projects could inadvertently pull in these malicious packages, leading to credential exfiltration (including API keys used by agent frameworks) and RAT-based compromise of the host running the agent.
Affected Systems
npm ecosystem projects using Vite frontend tooling; Node.js development and CI/CD environments that install the seven identified malicious packages as direct or transitive dependencies
Indicators of Compromise
- Malicious npm package names (seven packages under ViteVenom campaign - specific names not disclosed in source data)
- Tron blockchain addresses used for C2 resolution (not specified in source data)
- Associated ChainVeil four-tier blockchain C2 infrastructure indicators (not disclosed in source data)
Remediation Steps
- 1
Audit npm dependencies
Review package.json and lockfiles for any of the seven identified malicious Vite-related packages; remove and replace with verified legitimate versions.
- 2
Enable dependency scanning
Deploy software composition analysis (SCA) tools integrated into CI/CD to flag anomalous or newly published packages before installation.
- 3
Monitor outbound blockchain RPC traffic
Inspect build and developer environments for unexpected connections to blockchain RPC endpoints (e.g., Tron) which may indicate C2 resolution activity.
- 4
Rotate exposed credentials
If compromised packages were installed, rotate all API keys, tokens, and secrets accessible from the affected build/development environment, including those used by AI agents or automation pipelines.
- 5
Restrict automated package installation
Implement allowlisting or manual review gates for AI coding agents and automated pipelines that install npm packages to prevent unvetted dependency execution.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.