GCVE-110-OSM-2026-7510

@vite-ln/build-ts version 5.15.10 is one of seven malicious npm packages published between June 29 and July 3, 2026 as part of the ViteVenom campaign, attributed to the SuccessKey threat actor. The package uses a scoped name to impersonate the legitimate @vitejs/* namespace. Malicious code is embedded in bin/vite.js, disguised as a Vite CLI binary, and executes a four-stage blockchain C2 chain. ViteVenom shares Tier-2 blockchain infrastructure and an identical 77KB RAT with the earlier ChainVeil campaign by the same operator. The other six packages in this campaign are: @uw010010/vite-tree (3.4.2, 3.4.3, 3.6.1), @vite-tab/tab (3.15.10), @vite-mcp/vite-type (6.44.1), @vite-pro/vite-ui (2.5.10), @vitets/vite-ts (1.5.10), @vite-ts/vite-ui (6.44.1). All packages were reported to npm and removed on July 3, 2026; C2 infrastructure remained operational after removal. Safe action: remove package and rotate all credentials. **Execution vector** Malicious code embedded in `bin/vite.js`, disguised as a Vite CLI binary. Anti-replay guard prevents duplicate executions within a 30-second window. **Stage 0** Campaign marker stored as `global.i='*5-*'`. Sensitive values accessed via index lookup into a 63-element obfuscated string array (seed: 4606094) to avoid plaintext detection. **Stage 1 — blockchain resolution** Queries Tron blockchain for latest wallet transaction; falls back to Aptos if Tron fails. Decodes transaction data to obtain a BSC transaction hash, then fetches the encrypted payload from BSC using delimiter `?.?` to separate junk from ciphertext. **Stage 2A — dynamic execution** XOR-decrypts first payload (key: `2[gWfGj;<:-93Z^C`), executes via `eval()` in main process. BSC transaction: `0x5ab85abe6c67adb94322e5700a36915c38d1db1e604920da8aa4fcb530408af0` **Stage 2B — persistence** XOR-decrypts second payload (key: `m6:tTh^D)cBz?NM]`), spawns detached hidden child process (`detached: true, stdio: 'ignore', windowsHide: true`) that survives parent termination. Injects persistence code into shell config files hidden after 200+ whitespace characters. BSC transaction: `0xbcc976e1c8f3dfd93e146ff424836a9635ab36d991a54675635d7fdf30e60616` **Stage 3 — RAT (77KB)** Retrieved via shared Tier-2 blockchain infrastructure. Delivered via HTTP fallback at `/$/boot` endpoint using `Sec-V` header with campaign marker. Capabilities: reverse shell (WebSocket), credential harvesting, file exfiltration, arbitrary command execution via `child_process.exec()`. **Credential targets** - `~/.bashrc`, `~/.zshrc`, `~/.profile` (persistence + harvest) - `~/.ssh/*` (recursive) - `~/.npmrc` - macOS Keychain (OAuth tokens filtered by SHA256) **Network indicators** - `hxxp://198[.]105[.]127[.]210:443` — ViteVenom primary C2 - `hxxp://198[.]105[.]127[.]210:80` — alternate port - `hxxp://166[.]88[.]54[.]158:443` — ChainVeil primary C2 (shared RAT backend) - `hxxp://23[.]27[.]202[.]27:443` — tertiary C2 - `hxxp://23[.]27[.]202[.]27:27017` — MongoDB exfiltration **Blockchain indicators (Tier-1, ViteVenom-specific)** - Tron Stage 2A: `TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF` - Tron Stage 2B: `TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH` - Aptos Stage 2A: `0x9d202c824402ca89e9aaccd2390b6f8b332ae743caa1469c695feb2781d56519` - Aptos Stage 2B: `0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471` **Blockchain indicators (Tier-2, shared with ChainVeil)** - Tron: `TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v` - Aptos: `0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1` **File indicators** - `~/.bashrc`, `~/.zshrc`, `~/.profile` — check for injected code after 200+ whitespace characters