Seven Malicious npm Packages for Vite Used the Blockchain as a C2 Server

Cybersecurity specialists have identified a cluster of seven malicious npm packages targeting the ecosystem of Vite tools. The attack is classified as a software supply chain compromise.

The campaign was named ViteVenom by Checkmarx, the company that discovered it. Researchers note that it represents an evolution of the earlier ChainVeil campaign.

Blockchain Instead of a Conventional C2

The hallmark of the campaign is its use of a four-tier command-and-control (C2) infrastructure built on the blockchain. According to Checkmarx, such an architecture had not previously been seen in attacks of this kind. The infrastructure spans several blockchain networks, including Tron.

Using the blockchain for C2 communication makes it harder for traditional defenses to detect and block the malicious infrastructure, since decentralized networks are more difficult to take down or blacklist than ordinary servers.

The Goal of the Attack

The malicious packages are designed to deliver a RAT (Remote Access Trojan) — a piece of malware that lets attackers gain control over infected developer systems.

Because the attack targets Vite — a widely used build tool in modern frontend development — developers who install packages from npm without properly vetting their origin and contents could find themselves at risk.

The incident is yet another demonstration of the risks associated with open package repositories, and it underscores the importance of verifying dependencies before using them in projects.

Source: The Hacker News