npm Vite: 7 malicious plugins deliver RAT via blockchain C2—a C2 technique resistant to takedowns

Seven fake npm packages mimicking Vite plugins delivered a RAT to JavaScript developers. Unprecedented twist: their C2 infrastructure operates via a public blockchain—impossible for authorities to block, unlike a traditional server.

What Was Found

Researchers at Checkmarx identified seven malicious npm packages mimicking Vite plugins (the JavaScript build framework by Evan You) published on npmjs.com. The campaign, dubbed ViteVenom by Checkmarx, is part of an expansion of ChainVeil—a known supply chain operation already using advanced evasion techniques. When installed in a project, these packages silently delivered an RAT (Remote Access Trojan) to the developer’s machine.

The Blockchain C2 Technique: Why It’s New

The command-and-control (C2) infrastructure of this malware does not rely on traditional servers—whose IP or domain can be blocked or seized. Instead, it queries a public blockchain to read its instructions: attackers publish transactions with encoded commands, and the malware reads and executes them.

Why it’s hard to neutralize. Public blockchains are decentralized and immutable. Blocking a classic C2 domain is a standard procedure for authorities. “Blocking a blockchain” is technically impossible at internet scale. Additionally, network calls to a public blockchain generate fewer alerts than connections to an unknown domain.

What Frontend Developers Should Do

Verify your Vite dependencies now. Compare your packages against the official list of Vite plugins (vitejs.dev/guide/api-plugin). A single differing character in the name is enough.

Use npm ci instead of npm install in CI/CD—enforces lock file usage and checksum verification.

Socket.dev: behavioral analysis of npm packages (beyond known CVEs). Useful for detecting this type of implant.

Rotate tokens if compromised. If a suspicious package was executed on the machine: GitHub, npm, and cloud provider tokens—regenerate all.

Action now: Run npm audit in your Vite projects. Check any package with “vite” in the name not explicitly added. The Checkmarx advisory lists the exact names of the 7 malicious packages. Report suspicious packages to [email protected].