Checkmarx identified ChainVeil, an npm typosquatting campaign attributed to an actor it calls SuccessKey that distributed at least nine malicious packages containing a shared import-time loader. The loader used Tron, Aptos, and Binance Smart Chain transactions to resolve encrypted payloads, alongside a redundant direct HTTP channel. The final remote-access trojan supported credential theft, file exfiltration, remote command execution, and persistence through injected shell-configuration code. Researchers traced the infrastructure to June 2025, nearly a year before the npm packages appeared.