Sequel to ChainVeil npm malware: ViteVenom

Sequel to ChainVeil npm malware: ViteVenom - Checkmarx Zero

When we published our ChainVeil report in June 2026, we noted something that didn’t fit: the SuccessKey campaign’s Command and Control (Command and Control (C2)) infrastructure contained a secondary server at 198.105.127[.]210 and a tertiary server at 23.27.202[.]27 that no known ChainVeil package ever called home to. We predicted additional campaigns were already running on the same backend. We were right.

Checkmarx Zero has now identified a second package cluster — seven malicious npm packages targeting the Vite build tool ecosystem — that shares the same Tier-2 blockchain wallets, the same XOR (Exclu…