Sequel to ChainVeil npm Malware Targets Vite Ecosystem

Checkmarx Zero has identified a second cluster of malicious npm packages, dubbed ViteVenom, which is linked to the previously documented ChainVeil campaign. Attributed to the threat actor SuccessKey, this campaign specifically targets the Vite build tool ecosystem using scoped packages (e.g., @vite-pro/vite-ui) to impersonate legitimate tooling. The malware is designed to deliver a 77KB Remote Access Trojan (RAT) to developers.

The campaign is technically sophisticated, employing a four-tier Command and Control (C2) architecture that utilizes the Tron, Aptos, and Binance Smart Chain (BSC) blockchains to resolve payload pointers. This decentralized approach makes the infrastructure highly resilient to traditional takedown efforts. ViteVenom and ChainVeil share critical Tier-2 backend infrastructure, including identical XOR decryption keys and blockchain wallet addresses, confirming they are operated by the same entity.

This activity represents a persistent threat to the JavaScript development community. The use of scoped packages and the publication of clean versions alongside malicious ones are deliberate tactics to bypass manual reviews and automated security scanners. Organizations using Vite or related web development frameworks should immediately audit their dependency trees for the identified malicious packages and block the associated C2 infrastructure.