Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

**ViteVenom supply-chain malware campaign:** Checkmarx researchers identified seven malicious npm packages impersonating the @vitejs namespace that act as import-time loaders for a RAT, using multi-tier blockchain (Tron, Aptos, BSC) and HTTP fallback C2 to fetch encrypted payloads and configuration; the activity is linked to the actor SuccessKey and reuses infrastructure from the earlier ChainVeil operations, with guidance to remove packages, audit dependencies, rotate credentials, and check shell initialization files.