Critical

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

The Hacker News

July 17, 2026 at 6:54 PM

Actively Exploited

Overview

Researchers have uncovered seven malicious npm packages that are part of an attack targeting the Vite frontend framework. This operation, named ViteVenom by Checkmarx, is associated with a broader campaign known as ChainVeil, which employs a complex blockchain-based command-and-control system. The packages are designed to deliver a Remote Access Trojan (RAT), posing significant risks to developers using Vite. This type of supply chain attack can lead to unauthorized access to systems and sensitive data. Developers and organizations relying on Vite need to be vigilant and remove any affected packages to protect their environments.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Vite frontend framework, npm packages
Action Required: Developers should remove any malicious npm packages associated with Vite and ensure their environments are secure.
Timeline: Newly disclosed

Original Article Summary

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil, which was observed using an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron,

Impact

Vite frontend framework, npm packages

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Developers should remove any malicious npm packages associated with Vite and ensure their environments are secure.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Trojan.

Read Original Article

Related Coverage

Inc Ransomware Exploits SonicWall SMA Zero-Days

darkreading

Recent reports indicate that the Inc ransomware has exploited two zero-day vulnerabilities found in SonicWall's mobile access appliances. When combined, these vulnerabilities grant attackers root-level access, potentially allowing them to take full control of affected systems. This situation is particularly concerning for organizations that rely on SonicWall for secure remote access, as it could lead to significant data breaches or system compromises. Users and companies using SonicWall's mobile access appliances need to be aware of this threat and take immediate action to protect their systems. The exploitation of these vulnerabilities underscores the necessity for timely software updates and security measures.

Jul 17, 2026

HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload

BleepingComputer

A newly discovered vulnerability known as HollowByte poses a significant risk to OpenSSL servers by allowing unauthenticated attackers to create a denial-of-service (DoS) condition with a payload as small as 11 bytes. This flaw can lead to excessive memory consumption on affected servers, potentially causing them to crash or become unresponsive. The issue affects various OpenSSL implementations, which are widely used for secure communications on the internet. As the vulnerability is easy to exploit, it raises concerns for organizations relying on OpenSSL for their security infrastructure. Companies using OpenSSL should prioritize patching and implementing security measures to mitigate the risks associated with this vulnerability.

Jul 17, 2026

A cyberattack hit Nichirei, one of Japan’s largest food companies

Security Affairs

Nichirei, one of Japan's largest food companies, has experienced a significant cyberattack that has disrupted its logistics and shipment operations. The company is working to gradually restore its services after the attack, which has raised concerns about the impact on food supply chains. Founded in 1942 and based in Tokyo, Nichirei is widely recognized for its frozen food products and operates globally through numerous subsidiaries. As the incident unfolds, it underscores the vulnerabilities that large organizations face in today’s digital landscape, particularly those in critical sectors like food supply. This incident serves as a reminder for companies to bolster their cybersecurity measures to protect against potential disruptions.

Jul 17, 2026

What AI Fraud and Deepfake Failure Costs the Business

SCM feed for Latest

The article discusses the rising concerns around AI fraud and deepfakes, which pose significant risks to businesses across various sectors. These attacks often involve manipulating audio or video to impersonate individuals, potentially leading to financial losses and reputational damage. To combat these threats, it's crucial for organizations to foster collaboration among different departments, including security, finance, HR, and legal. This approach ensures a well-rounded defense against the multifaceted nature of these cyber threats. As AI technology continues to evolve, companies must stay vigilant and proactive in their security measures to protect against these sophisticated scams.

Jul 17, 2026

The Real AI Threat Is Blind Trust

darkreading

The article discusses the risks associated with AI models that are allowed to interpret and execute commands without adequate oversight. This blind trust in AI can lead to significant cybersecurity vulnerabilities, as there is a lack of human intervention to catch errors or malicious actions. The implications are serious, as organizations may unknowingly allow AI to make decisions that compromise their security. As AI systems become more integrated into business operations, the need for effective monitoring and control mechanisms becomes crucial to prevent potential exploitation. This situation raises concerns about how companies are managing AI technologies and ensuring they do not become a liability.

Jul 17, 2026

The Good, the Bad and the Ugly in Cybersecurity – Week 29

Cybersecurity Blog | SentinelOne

This week, authorities have taken action against Russian-based cybercriminals, marking a significant step in international cybersecurity efforts. Meanwhile, attackers have been deploying a new malware known as Starland, which poses a serious risk to users by potentially compromising their systems. Additionally, researchers have discovered around 300 fake GitHub repositories that are designed to distribute BoryptGrab, an infostealer that can harvest sensitive information from infected devices. These incidents highlight the ongoing challenges in cybersecurity, as attackers continue to evolve their tactics and target unsuspecting users. It is crucial for individuals and organizations to stay vigilant and implement robust security practices to defend against these threats.

Jul 17, 2026