Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron,

The article describes "ViteVenom," a software supply chain campaign where seven malicious npm packages masquerading as Vite tooling use a four-tier blockchain-based C2 infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a 77KB remote access trojan, primarily compromising developer workstations and their credentials.[1][2][3] These packages execute at import time and can exfiltrate SSH keys, npm tokens, cloud credentials, and source code, enabling broader enterprise compromise beyond the initial infected machine.[2][3] From a RealGround perspective, this highlights a critical AI-adjacent supply chain risk: any AI agents, LLM tooling, or model pipelines built on JavaScript/Vite ecosystems could be silently compromised via poisoned dependencies, leading to unauthorized code execution, data theft, or model and prompt exposure. Organizations should apply SBOM-driven dependency governance, lockfile enforcement, and continuous red teaming of development and AI-agent environments to detect malicious packages early, monitor for blockchain-based C2 patterns, and rotate credentials and rebuild systems when compromise is suspected.