Trojanized npm Packages Deliver AI-Assisted RedC2 4.0 Linux Backdoor, Trend Micro Finds

Overview

Researchers at TrendAI, Trend Micro’s enterprise cybersecurity business, have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an AI-powered Linux implant dubbed RedC2 4.0, according to The Hacker News. Cyber Security News independently reported the same TrendAI findings, saying the packages “deliver legitimate date functions, making the malicious code easy to miss.”

What We Know

TrendAI identified 14 malicious npm packages posing as date-math and “streak” tracking utilities, including streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, and streak-kit-map, according to The Hacker News. The packages are functional — they provide the date-utility features they advertise — but bundle a hidden Linux binary disguised as a “native math accelerator,” the outlet reported.

“When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process,” TrendAI said in a report, according to The Hacker News. “No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.” Cyber Security News corroborated the mechanism: “A direct or transitive import can trigger the implant, even if the developer never selected the package.” The outlet added that because the loader does not rely on npm lifecycle hooks, “using --ignore-scripts does not stop this route to execution.”

Security researcher Aliakbar Zahravi said the package entry file, dist/index.mjs, “acts as a trojan loader” that “re-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function required,” according to The Hacker News. Cyber Security News added that the same entry file “checks for the binary, changes its permissions and verifies its SHA-256 value before starting it as a detached process.”

The hidden payload is RedShell, a Linux beacon component of the RedC2 4.0 command-and-control framework that “communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host,” per The Hacker News. Once deployed, the Linux beacon “provides an interactive shell through ‘/bin/sh’ and exposes Linux-specific commands to enable system discovery, file operations, data collection (e.g., SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting,” the outlet reported. Cyber Security News similarly described RedShell as capable of running commands, opening a reverse shell, transferring files, and supporting “SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems.”

RedC2 4.0 is marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux offering “surveillance, credential theft, payload loading, and mass-operation capabilities,” according to The Hacker News. A threat actor using the handle “MarlboroMan” advertised the framework on Hack Forums in early June 2026, calling it a command-and-control framework “built for evasion,” the outlet reported. RedC2’s version 2.0 was released in August 2025 and version 3.0 was sold in January, indicating the framework has been under active development for at least a year; the RedShell Linux beacon was introduced in version 4.0. On a clearnet site branded Red Offsec, the seller advertises the framework for $99.99 and states its terms of service prohibit “unauthorized computer access” and “hacking without explicit permission,” per The Hacker News.

The framework also includes Red Agent, a large-language-model-driven component that lets operators “orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands,” according to The Hacker News. Zahravi described it as “an LLM-backed command execution layer that turns natural-language intent into framework beacon commands,” while Red Offsec itself calls it an “AI-powered command execution system specialized for penetration testing,” the outlet reported. Cyber Security News said Red Agent “turns a plain-language request into a sequence of commands for an infected system,” letting an operator “ask for reconnaissance or credential collection rather than manually issuing every step.”

Cyber Security News said the implant’s reach “extends beyond the initial host,” since it “can collect credentials, explore a network, move traffic through an infected machine and pull in extra tools,” putting “source code, cloud access and internal services at risk when a poisoned package reaches a trusted build chain.”

According to The Hacker News, the npm campaign “comes close on the heels of a coordinated supply chain attack affecting three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9), compromising them with a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds” — a separate crates.io incident the Rust Security Response Team disclosed on August 20. The outlet reported that investigators suspect a maintainer’s publishing credentials were compromised to push the poisoned npm packages. “Evidence points to infrastructure overlaps with prior software supply chain attacks targeting Mastra and Axios, both linked to North Korean threat actors,” the outlet reported.

What We Don’t Know

Neither report identifies how many downloads the 14 packages received before discovery, how long they remained available on the npm registry, or whether npm’s maintainers have removed them. Neither outlet names the compromised maintainer account, and TrendAI’s full report was not independently accessible at publication time. The extent of infrastructure overlap with the Mastra and Axios attacks — beyond the reported linkage to North Korean threat actors — was not detailed in either account.