Fake Developer Packages Found Delivering Remote Access Malware Through Blockchain Infrastructure
Security researchers have uncovered a new software supply chain campaign in which seven malicious npm packages impersonating tools for the Vite JavaScript framework were used to infect developers with a remote access trojan (RAT) delivered through an advanced blockchain-based command-and-control (C2) infrastructure.
Researchers at Checkmarx named the campaign ViteVenom, describing it as an evolution of the previously identified ChainVeil operation. Unlike traditional malware that relies on centralized servers, the attackers leveraged multiple blockchain networks to make their infrastructure more resilient and difficult to disrupt.
Malicious Packages Target Vite Developers
The attackers uploaded seven counterfeit npm packages disguised as legitimate Vite-related development tools. The packages remain inactive during installation, helping them evade casual inspection.
The malicious activity begins only after developers import the package into a project. At that point, embedded code launches a multi-stage infection chain that retrieves additional payloads from attacker-controlled infrastructure.
Blockchain Used to Hide Command Infrastructure
Instead of hardcoding command-and-control servers, the malware queries smart contracts hosted on Tron, Aptos, and BNB Smart Chain to obtain updated C2 information.
Researchers said this four-layer blockchain architecture allows attackers to modify server locations without updating the malware itself, making takedown efforts significantly more difficult than traditional C2 operations.
RAT Supports Credential Theft and Remote Control
Once deployed, the malware installs a remote access trojan capable of:
- Executing remote commands.
- Opening reverse shell sessions.
- Harvesting user credentials.
- Exfiltrating sensitive files.
- Establishing persistent access on compromised systems.
Because developers often possess privileged access to source code repositories, CI/CD pipelines, cloud environments, and production infrastructure, successful compromise could expose entire software supply chains rather than a single workstation.
Supply Chain Attacks Continue to Evolve
Researchers warn that attackers are increasingly targeting open-source ecosystems by publishing malicious packages that closely resemble legitimate developer tools.
The ViteVenom campaign demonstrates how threat actors continue adopting sophisticated infrastructure, including decentralized blockchain services, to improve malware resilience and complicate detection by defenders.
Developers Urged to Verify Dependencies
Security experts recommend that organizations:
- Verify npm package publishers before installation.
- Scan dependencies for malicious behavior.
- Restrict unnecessary package imports.
- Monitor developer environments for suspicious network activity.
- Continuously audit software supply chains.
As software ecosystems become increasingly dependent on third-party packages, strengthening dependency verification remains one of the most effective defenses against supply chain compromises.