Malicious Vite npm Packages: A New Supply Chain Threat

Cybersecurity researchers at Checkmarx have uncovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. Dubbed ViteVenom, the campaign is an evolution of an earlier operation called ChainVeil, which used a four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron,

The attackers are sneaking remote access trojans (RATs) into developer environments through packages that appear legitimate. If you’re a frontend developer using Vite, this is a wake-up call.

How the ViteVenom Attack Works

The malicious packages are designed to slip past standard security checks. They use blockchain transactions as their C2 channel, making detection far harder than traditional HTTP-based malware.

Checkmarx noted that ChainVeil’s C2 infrastructure was “unprecedented” because it relied on smart contracts to issue commands. ViteVenom continues that trend, embedding malicious code in packages that mimic Vite plugins or utilities.

The Seven Malicious Packages

While Checkmarx didn’t name all seven packages in public disclosures, the campaign targets developers who install Vite-related dependencies. The packages are likely published under names that resemble popular Vite plugins, a common typosquatting tactic.

Once installed, the RAT can steal credentials, exfiltrate source code, and even pivot to other systems on the developer’s network.

Why Blockchain C2 Is a Game-Changer for Attackers

Traditional C2 servers can be taken down by security teams. Blockchain C2, however, is decentralized. Commands are embedded in transactions on networks like Tron, making them nearly impossible to shut down.

This is a significant escalation in supply chain attacks. Security tools that rely on blocklists or domain reputation won’t catch this activity.

For developers, the risk is real: a single malicious package can compromise your entire project and your machine.

How to Protect Yourself from Malicious npm Packages

Here’s what you can do to stay safe:

• Audit your dependencies regularly with npm audit or tools like Snyk.
• Check package popularity and publish dates before installing. New packages with few downloads are red flags.
• Use lockfiles to pin exact versions and avoid surprise updates.
• Run scans for known malicious packages, especially those flagged by npm security advisories.
• Consider using a proxy registry that filters malicious packages.

Also, be cautious with packages that request broad permissions or include obfuscated code. If something looks off, inspect the code before running it.

What This Means for the Vite Ecosystem

Vite has become a go-to build tool for modern frontend projects, so it’s no surprise attackers are targeting it. The ViteVenom campaign shows that even trusted ecosystems aren’t immune.

Checkmarx’s findings highlight the need for stronger supply chain security. Developers should treat every dependency as a potential attack vector.

If you’ve installed any suspicious Vite-related packages recently, review your environment immediately. Remove unknown dependencies and rotate any credentials that might have been exposed.

The threat landscape is evolving, and blockchain-based C2 is just the beginning. Stay vigilant.

Eleven Bytes, 131 KB of Frozen Memory

Eleven bytes. That’s all it takes to make an unpatched OpenSSL server set aside up to 131 KB of memory for a message that never arrives. On glibc systems, that memory stays locked until the process restarts. Not great for a production server.

This is the HollowByte flaw, a denial-of-service bug that Okta’s Red Team found, named, and reported. The team published its findings after OpenSSL shipped a fix — quietly, with no CVE, no advisory, and no changelog entry pointing at it.

So how does a tiny TLS request cause so much damage? The trick lies in how OpenSSL handles certain message fragments. A crafted 11-byte request triggers an allocation that never gets freed. Repeat it enough times, and you’ve got a memory leak that grinds the server to a halt.

What Exactly Is HollowByte?

HollowByte is a memory exhaustion vulnerability in OpenSSL’s TLS handling. It doesn’t require authentication. It doesn’t need special privileges. Just a network connection and a carefully constructed request.

Okta’s Red Team discovered that sending a specific 11-byte TLS message causes the server to allocate memory for a response that never comes. On systems using glibc — the standard C library on most Linux distributions — that allocated memory isn’t reclaimed. It sits there, frozen, until the process dies.

The impact? An attacker can send repeated requests to exhaust available memory, effectively freezing the server. It’s a classic DoS vector, but with a twist: the trigger is absurdly small.

Why glibc Makes It Worse

The memory behavior isn’t universal. On some systems, the allocation gets cleaned up. But glibc’s allocator handles certain patterns differently, and that’s where the freeze happens. Okta’s testing showed the memory staying put until restart — no garbage collection, no cleanup, just a slow leak that compounds.

For organizations running OpenSSL on glibc-based systems, this is a real problem. A single connection isn’t dangerous. Thousands of them? That’s a different story.

OpenSSL’s Quiet June Fix

Here’s the part that’s raising eyebrows. OpenSSL patched HollowByte in June — but did it without a CVE, without a security advisory, and without a changelog entry that mentions the vulnerability.

That’s unusual. Security fixes typically get publicized so administrators know to update. A silent patch means many systems remain vulnerable, simply because nobody knows to apply the update.

Okta’s Red Team, which reported the bug and gave it the HollowByte name, published its research to fill that gap. The disclosure includes technical details on how the attack works and which versions are affected.

Who’s Affected and What to Do

If you’re running OpenSSL on a glibc-based system, you need to check your version. The fix shipped in June, so any version before that is vulnerable. The exact version numbers are in Okta’s disclosure.

Here’s what to do right now:

• Update OpenSSL to the latest patched version. Don’t wait for a CVE announcement.
• Check your changelog — if you’re on a version from June or later, verify it includes the fix.
• Monitor memory usage on TLS-facing servers. Unexpected spikes could indicate an attack.
• Restrict network access to TLS endpoints where possible, limiting who can send requests.

The update itself is straightforward. The challenge is knowing you need it.

The Bigger Problem: Silent Security Fixes

HollowByte highlights a broader issue in open-source security: fixes without fanfare. When a vulnerability is patched silently, the window of exposure stretches. Attackers who reverse-engineer the patch can exploit systems that haven’t updated — and they’ll do it before the news spreads.

Okta’s decision to publish the research after the patch is a pragmatic move. It alerts the community while giving administrators a heads-up. But it also raises questions: how many other HollowByte-style flaws are out there, patched but unannounced?

For security teams, the lesson is clear. Don’t rely solely on CVE alerts. Regularly audit your dependencies, track upstream changes, and test for unusual behavior. A silent patch is still a patch — but only if you apply it.

Interested in related security topics? Check out our guides on TLS certificate management and denial-of-service attack prevention for more context on keeping your infrastructure safe.

Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

The soft drinks giant confirmed on Monday that the recent ransomware attack on its dairy subsidiary Fairlife escalated into a full-blown data breach. Coca-Cola disclosed the cybersecurity incident on July 16, when it suspended production at Fairlife facilities across the United States while investigating the intrusion.

Now, the Anubis ransomware group has claimed responsibility and is threatening to leak stolen data. Here’s what we know so far.

What Happened: Fairlife Production Halted, Then Resumed

Coca-Cola initially announced the cyberattack on July 16, halting operations at four Fairlife facilities in the US. The company said it was working with law enforcement and cybersecurity experts to contain the threat.

By Monday, a statement from Coca-Cola confirmed that “a majority of production has been resumed” at those facilities. The company also acknowledged that the incident involved the “taking of certain data,” though it declined to share further details.

“Retail availability of Fairlife products has been largely unimpacted, due to the availability of existing inventory,” the statement read. “Product quality and safety have not been impacted.”

Anubis Ransomware Group Takes Credit, Threatens Leak

The Anubis ransomware group listed Coca-Cola and Fairlife on its leak website on July 20, claiming to have encrypted files and stolen 1 TB of confidential data. A timer on the site indicated that the stolen data would be made public within hours unless a ransom was paid.

It’s unclear exactly what type of data was compromised, but extortion gangs often exaggerate the importance of stolen files to pressure victims into paying. This is a common tactic in double-extortion schemes.

Who Is the Anubis Ransomware Group?

Active since December 2024, Anubis has listed roughly 100 targeted organizations on its website. The group uses a double-extortion model: encrypting files on compromised systems and exfiltrating valuable data to increase the chances of getting paid.

What sets Anubis apart is its ‘wiper mode’ feature, which allows it to permanently delete victims’ files and prevent recovery. This makes the group particularly dangerous, as even organizations with backups may lose critical data.

Impact on Coca-Cola and Fairlife

Coca-Cola stated that, based on current information, the incident has not had and is not reasonably likely to have a material impact on the company’s financial condition or results of operations.

Still, the breach raises concerns about the security of supply chain partners. Fairlife, a popular dairy brand, relies on Coca-Cola’s distribution network, and any prolonged disruption could affect retail availability.

Related incidents in the dairy and food sector have shown that ransomware attacks can have cascading effects. For example, the DentaQuest data breach impacted over 23 million people, and the MCBS data breach affected 1.2 million individuals. Even Australian energy giant Origin faced a data breach after being hacked.

What Should Businesses Learn from This?

The Fairlife attack underscores the importance of robust cybersecurity measures, especially for subsidiaries of large corporations. Attackers often target smaller entities within a larger organization, knowing they may have weaker defenses.

Key takeaways for businesses:

• Ensure subsidiaries and third-party partners have strong security protocols.
• Regularly back up critical data and test recovery procedures.
• Monitor for signs of double-extortion ransomware, including wiper capabilities.
• Have a response plan that includes communication with customers and regulators.

As the Anubis group continues its activities, the cybersecurity community will be watching closely. For now, Coca-Cola and Fairlife are left to manage the fallout of a breach that could have been prevented with stronger defenses.