ChainVeil attack hides malware in vite.config.js via forged merge commit

Researchers detailed a campaign targeting the npm and Vite ecosystem: after one machine is infected, attackers steal Git credentials and force-push obfuscated code into vite.config.js. The payload runs on npm run build, retrieves its C2 address from the Ethereum blockchain (EtherHiding) and executes arbitrary code via eval.

• Malware is appended to the end of vite.config.js; git diff shows only 2 insertions
• C2 address is read from public Ethereum, TRON, Aptos or BNB Chain blockchains
• Within 14 minutes of a legitimate merge, about a dozen branches were rewritten, fastest in 2 seconds
• Forged merge commit lacks a PGP signature and lists a user instead of GitHub as committer