Published on August 22, 2026
Trojanized npm Packages Deliver RedC2 4.0 Linux Backdoor with AI-Assisted
Severity
High
Detail
Cybersecurity researchers have identified multiple trojanized npm packages that appear to provide legitimate calendar and streak utilities but are designed to secretly deliver an AI-powered Linux implant known as RedC2 4.0.
When one of the affected modules is loaded, it locates a bundled binary, makes it executable, and launches it as a detached background process. The attack does not require an install hook because simply importing the malicious module anywhere in the dependency graph, including as a transitive dependency, is sufficient to execute the payload.
The affected packages are functional and provide their advertised date-related functionality. However, their package code also contains a Linux backdoor disguised as a native math accelerator. The bundled files use names including math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, and calc-mapping.bin. The malicious binary is located either directly under the dist/ directory or within dist/internal/. Regardless of the filename or location, the binary contains the RedShell Linux beacon associated with RedC2 4.0.
How?
The malicious packages use dist/index.mjs as a trojanized loader. The file re-exports the legitimate date utilities while also launching the bundled RedShell implant whenever the module is loaded. No installation hook or exported function needs to be invoked. A single import anywhere within the dependency graph, including through a transitive dependency, can trigger execution of the Linux implant.
Once deployed, RedShell communicates with a remote Windows or Linux C2 server. It initially gathers basic information about the compromised system and sends the information to the C2 server as a check-in message. It then enters a command-processing loop, executing received instructions through /bin/sh and returning the results to the operator.
Impact
RedC2 4.0 is described as a cross-platform toolkit supporting Windows, macOS, and Linux. It provides surveillance, credential theft, payload loading, and mass-operation capabilities.
The Linux beacon provides an interactive /bin/sh shell and supports capabilities including:
• System discovery
• File operations
• Data collection, including SSH keys and browser credentials
• Command execution
• Persistence
• In-memory ELF execution
• SOCKS5 proxying
• Network pivoting
The broader RedC2 framework also supports terminal access, file transfers, staged payload delivery, data collection, multiple beacons, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files, .NET assemblies, and shellcode.
RedC2 also includes Red Agent, an LLM-backed command execution component that converts natural-language instructions into framework beacon commands. This allows operators to orchestrate complex post-exploitation activities, including network reconnaissance and credential dumping, through natural-language commands.
The findings indicate that AI-integrated C2 frameworks can be distributed through malicious npm packages while reducing the technical barrier for operators to perform complex, multi-stage intrusions.
Indicators of Compromise (IOCs)
The identified trojanized npm packages are:
• streak-metrics-math@1.0.0, 1.0.1
• kit-map-vim@1.0.0
• streak-map-cache@1.0.0
• streak-map-kit@1.0.0
• map-streak-kit@1.0.0
• streak-cache-map@1.0.0
• streak-calc-metrics@1.0.0
• streak-calc-math@1.0.0
• streak-math-abz@1.0.0
• streak-metricsaz@1.0.0
• streak-math-metrics@1.0.0
• streak-metricazbd@1.0.0
• streak-metricsazb@1.0.0
• streak-kit-map@1.0.0
Associated bundled payload filenames include:
• math-core.bin
• math-calc.bin
• calc-math.dat
• calc-cache.bin
• calc.bin
• calc-mapping.bin
Conclusion
The discovery of trojanized npm packages delivering the RedShell Linux beacon demonstrates how legitimate-looking software packages can be used to distribute cross-platform post-exploitation malware.
RedC2 4.0 provides extensive capabilities for system discovery, credential theft, command execution, persistence, data collection, network tunneling, and payload execution. Its Red Agent component further introduces an LLM-based interface that allows operators to translate natural-language instructions into actionable beacon commands.
The campaign highlights the combination of software supply chain abuse and AI-assisted C2 capabilities, potentially enabling operators with different levels of technical expertise to conduct complex post-exploitation activities.
Source
https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html