Trojanized npm utilities launch RedC2 4.0 Linux implant

Fourteen npm packages conceal a Linux backdoor

Researchers have identified 14 trojanized npm packages that present themselves as calendar and streak-management utilities while deploying the RedC2 4.0 Linux backdoor. TrendAI, Trend Micro’s enterprise cybersecurity business, said the packages are functional, but their entry module also launches a bundled RedShell Linux beacon.

The affected releases include streak-metrics-math@1.0.0 and 1.0.1, kit-map-vim@1.0.0, streak-map-cache@1.0.0, streak-map-kit@1.0.0, map-streak-kit@1.0.0, streak-cache-map@1.0.0, streak-calc-metrics@1.0.0, streak-calc-math@1.0.0, streak-math-abz@1.0.0, streak-metricsaz@1.0.0, streak-math-metrics@1.0.0, streak-metricazbd@1.0.0, streak-metricsazb@1.0.0 and streak-kit-map@1.0.0.

The delivery mechanism is significant because it does not rely on a package installation hook. Security researcher Aliakbar Zahravi said dist/index.mjs re-exports the advertised date helpers while acting as a trojan loader. When a module loads, it locates the embedded binary, makes it executable and starts it as a detached background process. That means a direct import, or a transitive import deeper in an application’s dependency graph, can execute the payload.

Native-looking files carry the RedShell beacon

The implant is framed as a native math accelerator and appears under names including math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin and calc-mapping.bin. It is stored either directly in dist/ or in dist/internal/, but the underlying payload is the same RedShell beacon for RedC2 4.0.

Once active on Linux, RedShell provides an interactive shell through /bin/sh. It can perform system discovery, file operations, data collection such as SSH keys and browser credentials, persistence, in-memory ELF execution, SOCKS5 proxying and network pivoting. It gathers basic host information for a check-in message to its command-and-control server, then processes operator instructions and returns command results.

RedC2 4.0 is marketed on cybercrime forums as a cross-platform framework for Windows, macOS and Linux. The framework supports terminal access, file transfers, staged payload delivery, multi-beacon operations, network visualisation, host-to-host tunnelling and in-memory execution of Beacon Object Files, .NET assemblies and shellcode. The Linux RedShell beacon was introduced with version 4.0.

An AI-assisted command layer raises the supply-chain risk

The framework also includes Red Agent, an LLM-backed command execution layer intended to convert natural-language requests into beacon commands. TrendAI said this abstraction can enable operators with varying skill levels to execute multi-stage intrusions. The malware campaign follows a wider pattern of poisoned open-source dependencies, including npm supply-chain activity formed part of the week’s threat landscape where npm supply-chain activity formed part of the week’s threat landscape.

For development and security teams, the immediate implication is to review both direct and transitive npm dependencies for the named packages and versions, and to investigate unexpected executable files or detached processes launched from dependency directories. Dependency approval, version pinning and runtime monitoring should account for package imports that initiate code outside the advertised JavaScript functionality.