Cybersecurity researchers have uncovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem in a software supply chain attack that uses blockchain infrastructure for command-and-control communication. The campaign, dubbed ViteVenom by Checkmarx researchers, represents an evolution in attack techniques.
The malicious packages, which were published to the npm registry, are designed to compromise development environments that install them as dependencies. Once activated, they establish communication with a command-and-control infrastructure that operates across the Tron blockchain network, making the C2 traffic more difficult to detect and block using traditional network security tools.
Using blockchain-based C2 represents an advancement in attacker tradecraft. By encoding commands in blockchain transactions, the attackers can operate with a level of resilience that is difficult to disrupt. The distributed nature of blockchain means there is no single server to take down, and the traffic blends with legitimate cryptocurrency activity.
The packages targeted developers working with Vite, a popular build tool for JavaScript and TypeScript applications that has gained significant adoption in the web development community. Developers who installed the compromised packages would inadvertently introduce the malicious code into their development environments and potentially into the production applications they deploy.
The discovery follows a pattern of increasing supply chain attacks targeting the JavaScript ecosystem. The npm registry, which hosts over two million packages, has become a preferred vector for attackers seeking to compromise software at scale. Developers are advised to carefully review package dependencies, verify package integrity, and scan for suspicious code before integrating third-party packages into their projects.
This article was adapted from The Hacker News. Read the original here.
