OpenSourceMalware attributes the ChainVeil and ViteVenom npm supply-chain operations to PolinRider, a North Korean Lazarus Group campaign, based on identical TRON wallets, an Aptos address, XOR keys, campaign markers, and targeting patterns. The blockchain indicators were published in its March 8 PolinRider analysis before the first ChainVeil package appeared, while wallet rotations trace the infrastructure to June 2025. The activity used malicious Tailwind- and Vite-themed packages and forms part of a campaign that has expanded across GitHub, Go, Packagist, npm, and PyPI.