opensourcemalware.comPublished
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
Excerpt
On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel spanning TRON, Aptos, and Binance Smart Chain. Four weeks later, on July 14, they followed up with a sequel on "ViteVenom," seven typosquats targeting the Vite ecosystem. They assessed with high confidence that it shares an operator with ChainVeil, while noting that "blockchain attribution carr…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by opensourcemalware.com on opensourcemalware.com.
Mentioned in the excerpt
More from opensourcemalware.com4
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font Fileopensourcemalware.com · Published 16 Oct
- WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentialsopensourcemalware.com · Published 17 Sep
- PolinRider Confirmed Footprint Grows 6.5x Since Marchopensourcemalware.com · Published 15 Jul
- Lazarus Group Uses Git Hooks To Hide Malwareopensourcemalware.com · Published 6 May
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Attackers Target Agents via The Skill Supply Chainzenity.io · Published 6 Aug
