Somewhere between "npm install" and "it works on my machine," seven very convincing package names slipped into the Vite ecosystem carrying a remote access trojan with a command-and-control system so elaborate it makes most heist movies look under-budgeted. Three blockchains. Encrypted payloads. A wallet-based dead drop. All to own a developer's laptop.

Seven Packages, One Blockchain-Powered Backdoor

Researchers at Checkmarx uncovered a campaign dubbed ViteVenom: seven malicious npm packages published between June 29 and July 3, using scoped names designed to impersonate the legitimate "@vitejs/" namespace. Once imported — not installed, imported, which is the detail that should worry you — the packages deploy a remote access trojan capable of opening a reverse shell, harvesting credentials, exfiltrating files, and planting a persistent backdoor.

The command-and-control infrastructure is where this gets genuinely wild: the malware checks the Tron blockchain for the attacker's latest transaction, decodes it to find a Binance Smart Chain transaction hash, pulls an encrypted payload out of that transaction's input field, and decrypts it with a hardcoded key — with Aptos standing by as a backup channel. Researchers have tied the campaign to a threat actor called SuccessKey, with linked crypto wallets active as far back as February 27.

Why Blockchain C2 Should Worry You More Than Ransomware Headlines

Traditional command-and-control servers can be seized, sinkholed, or taken down with a phone call to a hosting provider. A C2 channel built on three separate public blockchains is, by design, nearly impossible to kill — there's no server to raid, just an immutable ledger quietly waiting to hand out its next instruction. That's a genuine escalation in how resilient supply-chain malware can be.

The "executes on import, not install" trick is the other quiet menace here — most endpoint security and CI scanning tools are tuned to flag suspicious install scripts, which means this campaign was built specifically to slide past exactly the defenses developers already trust.

If you've touched a Vite-adjacent package in the last three weeks, this is your sign to check your lockfile like you mean it.

Source: The Hacker News