Forged Git commits silently plant malware in Vite build configs via stolen credentials

Security researchers have documented a supply-chain attack campaign — tracked under names including ChainVeil, ViteVenom, and PolinRider — that targets developers using npm and Vite. Attackers first infect one team member's machine to steal Git hosting credentials, then use those credentials to force-push a poisoned commit that appends obfuscated malware to vite.config.js across all reachable branches within minutes. The malicious code is hidden after hundreds of whitespace characters near the end of the file, making it nearly invisible in standard diff views and undetectable by dependency audit tools. Once any team member runs npm run build, the payload executes, establishes a connection to a command-and-control server whose address is retrieved from a public Ethereum blockchain, and can receive and run arbitrary code. If CI/CD pipelines are active, the compromise can propagate automatically all the way through to production and staging deployments.