Loading story…
Researchers identified seven malicious npm packages masquerading as Vite-related tooling in a software supply chain campaign dubbed ViteVenom. The packages, linked to the SuccessKey threat actor and described as an expansion of the earlier ChainVeil activity, were published under deceptive Vite-themed namespaces and triggered malicious code at import time through bin/vite.js rather than during installation. The malware used a resilient four-tier blockchain-based command-and-control architecture spanning Tron, Aptos, and Binance Smart Chain, with an HTTP fallback, before delivering a remote access trojan capable of reverse shell access, credential theft, file exfiltration, and persistence.
The campaign primarily put developer workstations at risk, with potential exposure of browser sessions, SSH keys, npm tokens, cloud credentials, API keys, and source code repositories that could enable wider enterprise compromise. Investigators tied ViteVenom to ChainVeil through shared Tier-2 blockchain infrastructure and XOR keys despite changes in package names, maintainer accounts, file paths, and first-stage wallets. Organizations were urged to remove the packages, audit manifests, lockfiles, node_modules, and CI caches, inspect shell startup files and suspicious Node.js activity, review outbound connections to the identified infrastructure, rotate compromised secrets, and rebuild high-risk systems where infection is confirmed.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
A social media post stated that ChainVeil and ViteVenom are part of the North Korea-linked PolinRider campaign, citing a publication by OpenSourceMalware. The post did not provide additional technical details, indicators, or victim information beyond the attribution claim.
Checkmarx Zero identified the ViteVenom campaign and linked it to the earlier ChainVeil npm malware cluster based on shared Tier-2 blockchain infrastructure and XOR keys. The campaign was also attributed to a threat actor tracked as SuccessKey.
The identified malicious packages impersonating Vite-related tooling were published to npm between June 29 and July 3, 2026. The packages executed malicious code at import time and were used to deliver a RAT via blockchain-backed command-and-control infrastructure.
OpenSource Malware published analysis concluding that the ChainVeil and ViteVenom npm supply-chain campaigns are part of the broader DPRK-linked PolinRider operation attributed to Lazarus. The report cited exact overlaps in blockchain C2 infrastructure, including two TRON wallets, one Aptos address, two XOR decryption keys, and shared tradecraft markers.
Checkmarx reported the seven malicious Vite-themed npm packages to npm, and the packages were taken down on July 3, 2026. The report noted that despite the removals, the shared blockchain infrastructure and C2 servers remained online.
On June 16, 2026, Checkmarx Zero reported the ChainVeil npm supply-chain campaign, attributing it to the actor SuccessKey and describing at least nine malicious packages and 14 versions published between May 18 and June 10. Checkmarx said the packages had been reported and removed, but assessed the campaign as ongoing because its blockchain-backed and HTTP fallback C2 infrastructure remained active.
Researchers said evidence of the malicious npm campaign dates back to February 27, 2026. The activity was later tied to the Vite-focused software supply chain operation dubbed ViteVenom.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebsky.app
Open sourcebsky.app
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourceopensourcemalware.com
Open sourcecheckmarx.com
Open sourcecheckmarx.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the GitHub account of maintainer Jared Wray and used legitimate GitHub Actions workflows to publish malicious npm releases for **`keyv`** and multiple **cacheable-family** packages, seeding a supply-chain worm now described as **ChainDrop**, a variant of **Shai-Hulud**. Researchers said the campaign expanded from an initial set of 11 malicious releases to **444 infected packages**, touching dependencies such as **`keyv`**, **`flat-cache`**, and **`cache-manager`** that together see roughly **2 billion monthly downloads**. The poisoned packages carried valid GitHub-signed provenance, but the malicious payload was inserted into npm tarballs and obfuscated `preinstall` paths, allowing the attack to evade checks that rely on source-repository visibility. The malware stole **npm tokens, GitHub credentials, cloud keys, environment variables, shell data, and secrets from memory**, then encrypted and exfiltrated the data after resolving command-and-control infrastructure through an **Ethereum smart contract**. It also planted persistence in repository and IDE configuration files including **`.claude/settings.json`** and **`.vscode/tasks.json`**, meaning simply opening a seeded repository in tools such as VS Code or Claude Code could trigger compromise and further spread. With stolen GitHub access, the worm enumerated repositories and branches, committed malicious configuration files, and installed a revocation-triggered kill switch tied to stolen tokens; defenders were urged to roll back to known-safe versions, inspect branches for unauthorized config changes, remove persistence before revoking credentials, and treat any host that installed affected packages or opened a seeded repository as compromised.
Aug 22, 2026
A software supply chain compromise hit the JavaScript ecosystem after malicious versions of **Keyv** and related npm packages were published through legitimate maintainer workflows, with `keyv@6.0.0` identified as a primary malicious release. Researchers said the tainted packages added a `preinstall` hook that executed attacker code during dependency installation on developer workstations and CI runners, while some repositories also contained malicious **VS Code** and **Claude Code** configuration files that could trigger execution when a cloned project was opened. Early community reports tied the incident to the `jaredwray/cacheable` package set and warned that numerous downstream dependencies were exposed. Analysis found the malware targeted high-value secrets including **GitHub** and **npm** tokens, cloud credentials, Vault tokens, Kubernetes service account tokens, SSH keys, and TLS certificates, with tradecraft resembling the **Shai-Hulud** malware family. Investigators reported no evidence that npm itself was breached; instead, the attackers appear to have used stolen maintainer credentials and trusted GitHub Actions publishing pipelines with valid provenance and npm attestation, demonstrating that provenance verified the build source but not whether the source had already been maliciously altered. Responders were urged to avoid affected versions, isolate any host that installed them, remove persistence such as `gh-token-monitor`, and rotate exposed credentials from a clean system.
Aug 8, 2026
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026