The rules I build by

Malware is being planted in build configurations through forged merge commits, targeting the npm and Vite ecosystem. Users can be infected simply by executing git pull and npm run build, which triggers a connection to an external server via vite.config.js. Security vendors have identified this campaign under names like ChainVeil, ViteVenom, and PolinRider. The attack does not require opening suspicious files or installing new packages, making it a significant threat to developers using these tools.