New npm malware cluster targets Vite ecosystem

As outlined in The Hacker News, Checkmarx cybersecurity researchers have uncovered a new cluster of seven malicious npm packages, dubbed ViteVenom, that are specifically targeting developers using the Vite frontend tooling ecosystem. This represents an expansion of previous software supply chain attacks.

The ViteVenom campaign, attributed to the threat actor SuccessKey, builds upon the tactics seen in the earlier ChainVeil attack. It utilizes a sophisticated, multi-tier blockchain-based command-and-control infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). This RAT is capable of executing a reverse shell, harvesting credentials, exfiltrating files, and injecting persistent backdoors. Unlike previous attacks, ViteVenom employs scoped package names to impersonate the "@vitejs/*" namespace, aiming for increased legitimacy.

The malware's malicious code executes at import time, not install time, to evade endpoint security detections. It queries blockchains to retrieve encrypted payloads, making the C2 infrastructure extremely difficult to dismantle. Users who may have installed these packages are strongly advised to remove them immediately, audit their dependencies, rotate all credentials, and check for unauthorized system modifications.

Source: The Hacker News