Cybersecurity researchers discovered 14 trojanized npm packages disguised as calendar and streak utility tools that secretly deliver a Linux backdoor called RedC2 4.0. The malware is AI-powered and features an AI-assisted command-and-control (C2) infrastructure. Upon loading, the malicious module locates a bundled binary, marks it executable, and launches it as a detached background process to avoid detection. The campaign was uncovered by TrendAI, Trend Micro's AI-focused research division. This represents a supply chain attack targeting developers who install seemingly legitimate npm packages. The use of AI in the C2 infrastructure marks an evolution in malware sophistication. The attack specifically targets Linux environments, making it relevant to server and cloud infrastructure. Developers and organizations relying on npm ecosystems are at elevated risk from this campaign.
Fourteen trojanized npm packages masquerading as calendar and streak utilities deliver a Linux backdoor called RedShell, part of the RedC2 4.0 C2 framework. The packages are fully functional but embed a malicious binary (disguised as a native math accelerator) in the 'dist/' or 'dist/internal/' directory under filenames like math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, and calc-mapping.bin. The entry file (dist/index.mjs) acts as a trojan loader: it re-exports legitimate date helpers while simultaneously launching the embedded implant as a detached background process on module import, requiring no install hook or explicit function call. A single transitive import in the dependency graph is sufficient to trigger payload execution. The RedShell Linux beacon communicates with a remote C2 server (Windows or Linux), registers the infected host via a check-in message containing system info, then enters a command-processing loop executing instructions via /bin/sh and returning results. Capabilities include interactive shell access, file operations, SSH key and browser credential harvesting, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting. The Windows beacon additionally supports UAC bypass, AV/EDR tampering, and lateral movement. RedC2 4.0 also includes an LLM-driven component called Red Agent that translates natural-language operator prompts into beacon commands, lowering the skill barrier for complex multi-stage intrusions. The framework supports in-memory execution of BOFs, .NET assemblies, and shellcode, as well as multi-beacon operation, network visualization, host-to-host tunneling, and staged payload delivery. RedC2 is sold on clearnet under the brand Red Offsec for $99.99 and was advertised on Hack Forums in June 2026 by threat actor 'MarlboroMan'. Version history: v2.0 released August 2025, v3.0 January 2026, v4.0 (introducing RedShell Linux beacon) mid-2026.
1. Immediately audit your project dependency trees (including transitive dependencies) for any of the 14 identified malicious npm packages and remove them. 2. Scan for the presence of suspicious binary files (math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin) in node_modules directories. 3. Monitor for unexpected detached background processes spawned during npm module loading. 4. Implement software composition analysis (SCA) tools to continuously monitor dependencies for known-malicious packages. 5. Use npm audit and registry integrity checks to validate package authenticity before installation. 6. Inspect dist/index.mjs files in unfamiliar packages for loader behavior that spawns binaries. 7. Monitor network traffic for unexpected outbound C2 communications, particularly from Node.js processes. 8. Check for signs of persistence mechanisms, SSH key exfiltration, browser credential theft, and SOCKS5 proxy activity on affected Linux hosts. 9. Enforce allowlisting of approved npm packages in CI/CD pipelines. 10. Rotate any SSH keys and credentials on systems that may have loaded these packages. 11. Apply endpoint detection rules to flag in-memory ELF execution and /bin/sh spawning from npm processes.
Malicious npm packages: streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, streak-kit-map, Malicious binary filenames: math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin, Malicious file paths: dist/, dist/internal/, Trojan loader file: dist/index.mjs, Beacon shell execution via: /bin/sh, C2 framework brand: Red Offsec / RedC2 4.0, Threat actor alias: MarlboroMan, Forum: Hack Forums (advertisement June 2026), Clearnet site: Red Offsec website
