Checkmarx identified seven malicious npm packages that impersonated Vite-related scopes and delivered an obfuscated remote-access trojan through Tron, Aptos, and Binance Smart Chain infrastructure. Shared wallets, XOR keys, loader structure, and payloads link the ViteVenom cluster to the earlier ChainVeil campaign, although the researchers cannot completely exclude a shared-service model. The article attributes the activity to a common malware operator but does not connect that operator or either campaign to North Korea.