Skip to content

ChainVeil

Named by 3 kept items in this workspace.

Search every workspace for ChainVeil. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • PolinRider Caused Dozens of npm, Go, PHP Compromises
    writeup2026-07-31It is written here as ChainVeil (SuccessKey).

    DPRK/PolinRider-linked npm supply chain attack analyzed by Checkmarx Zero in June; its malware credential harvester runs harvest("~/.npmrc", ".npmrc") alongside SSH key and browser password theft; shares XOR key ThZG+0jfXE6VAGOJ and A6- Sec-V marker with this campaign.

  • The OpenSourceMalware Show #14
    talk2026-07-23

    Supply chain campaign published by Checkmarx targeting npm; ~13 packages published June/July timeframe; linked to PolinRider via five byte-for-byte identical IOCs (wallets, XOR keys, an Aptos address).

  • ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
    writeup2026-07-17

    npm supply chain campaign published by Checkmarx Zero on June 16, 2026: nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel spanning TRON, Aptos, and Binance Smart Chain. Checkmarx named the operator "SuccessKey." Assessed by OpenSourceMalware to be Pol

All threat actors in this workspace.