14 Trojanized npm Packages Deliver RedC2 4.0 Linux Backdoor With AI-Powered C2
Cybersecurity researchers have uncovered 14 trojanized npm packages that masquerade as legitimate calendar, streak, and date-related utilities but secretly deliver a Linux backdoor associated with RedC2 4.0, an AI-integrated command-and-control framework.
According to TrendAI, the malicious packages contain a bundled Linux binary that is launched automatically when the affected module is imported. This means developers do not need to explicitly call a malicious function or execute an installation hook. A single import anywhere in the dependency tree, including through a transitive dependency, can be enough to trigger the payload.
Affected npm Packages
The identified malicious packages include:
[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
The packages are particularly concerning because they are not simply empty or obviously malicious modules. They provide the functionality they advertise while hiding malicious code underneath.
The packages contain files presented as native mathematical components, including:
math-core.bin math-calc.bin calc-math.dat calc-cache.bin calc.bin calc-mapping.bin
These files are actually associated with the RedShell Linux beacon, the Linux component introduced with RedC2 version 4.0.
Malicious Code Executes During Module Loading
The malicious delivery mechanism resides in the package's dist/index.mjs entry file.
Rather than relying on a traditional npm install script, the file acts as a trojanized loader. When the package is imported, it:
- Locates the bundled binary.
- Changes its permissions to make it executable.
- Launches the binary as a detached background process.
- Continues providing the legitimate package functionality.
This approach makes the compromise particularly dangerous because conventional defenses focused on npm installation hooks may not detect the execution.
TrendAI researcher Aliakbar Zahravi explained that no exported function needs to be called for the malicious code to execute. Simply loading the module is sufficient.
RedC2 4.0
The payload is linked to RedC2 4.0, a cross-platform command-and-control framework advertised on underground cybercrime forums.
RedC2 supports Windows, macOS, and Linux, and has been marketed as an offensive security framework designed with evasion as a core principle.
The framework has reportedly been under development for at least a year:
- RedC2 2.0: August 2025
- RedC2 3.0: January 2026
- RedC2 4.0: June 2026
Version 4.0 introduced the RedShell Linux beacon.
The framework supports capabilities including:
- Interactive terminal access
- File transfer
- Payload delivery
- Data collection
- Multiple beacon management
- Network visualization
- Host-to-host tunneling
- In-memory execution
- Beacon Object Files (BOFs)
- .NET assemblies
- Shellcode execution
RedShell Linux Capabilities
Once deployed on a Linux system, RedShell provides attackers with an interactive shell through /bin/sh.
It also supports Linux-specific capabilities for:
- System reconnaissance
- File management
- Data collection
- SSH key collection
- Browser credential collection
- Command execution
- Persistence
- In-memory ELF execution
- SOCKS5 proxying
- Network pivoting
The implant initially communicates with its command-and-control server and sends a check-in message containing information about the infected system.
After registration, the malware enters a command-processing loop where it receives instructions from the operator, executes them, and sends the results back to the C2 server.
Cross-Platform Capabilities
RedC2 is not limited to Linux.
Its Windows and macOS components reportedly provide capabilities for:
- File operations
- Host reconnaissance
- Network reconnaissance
- User enumeration
- Data harvesting
The Windows version additionally includes capabilities such as:
- UAC bypass
- Antivirus and endpoint detection
- Security software tampering
- In-memory execution
- Lateral movement
AI-Powered Red Agent
One of the most notable aspects of RedC2 4.0 is its AI integration.
The framework includes a component called Red Agent, an LLM-powered command execution layer that allows operators to issue instructions using natural language.
Instead of manually constructing every individual command, an operator can provide a high-level objective and the AI component translates that intent into commands that can be executed through the RedC2 framework.
Potential activities include:
- Network reconnaissance
- Credential dumping
- Post-exploitation operations
- Host discovery
- Command execution
This effectively lowers the technical barrier for operating a complex command-and-control framework.
TrendAI noted that operators with different levels of technical expertise could use the natural-language interface to orchestrate multi-stage operations more efficiently.
RedC2 Marketed as an Offensive Security Framework
The operators behind RedC2 market the framework through a website branded Red Offsec.
The framework is advertised as a multi-language, multi-operating-system C2 platform for Windows, Linux, and macOS, with evasion positioned as a core design principle.
RedC2 is reportedly offered for $99.99.
Interestingly, the service's terms of use prohibit customers from using the tool for unauthorized access, hacking without permission, or damaging systems they do not own or have authorization to test.
Despite those restrictions, the capabilities of the framework make it potentially useful for malicious operations.
Why the npm Supply-Chain Attack Is Significant
The campaign highlights an important evolution in software supply-chain attacks.
Instead of publishing an obviously malicious package, the attackers created packages that appear to provide legitimate functionality.
The malicious code is hidden behind names associated with calendar, streak, mapping, and mathematical utilities.
The packages also avoid relying on an npm installation hook, which can make traditional package-security checks less effective.
The most important execution condition is simply:
The malicious package gets imported.
This means a developer could potentially be affected even if the malicious dependency is introduced indirectly through another package.
Broader Supply-Chain Threat
The RedC2 campaign comes shortly after another major software supply-chain incident involving several Rust crates, including:
Those packages were compromised through a malicious proc-macro1 dependency that executed malware during Cargo builds.
Together, the incidents demonstrate how attackers are increasingly abusing legitimate package ecosystems to distribute malware.
The npm ecosystem is particularly attractive because a single compromised dependency can potentially reach large numbers of downstream projects.
What Developers Should Watch For
Developers should carefully review dependencies for unexpected packages, especially recently published packages with unusual or suspicious names.
Organizations should also monitor for:
- Unexpected child processes spawned by Node.js applications
- Node.js processes launching unknown binaries
- New executable files appearing under project directories
- Unexpected outbound connections from development environments
- Unknown Linux processes running in the background
- Suspicious persistence mechanisms
- Unexpected access to SSH keys or browser credential stores
- Newly introduced dependencies that are not required by the application
Dependency lockfiles and software composition analysis can also help identify unexpected package changes.
Key Takeaway
The RedC2 campaign demonstrates how software supply-chain attacks, Linux malware, and AI-assisted offensive tooling are increasingly converging.
The malicious npm packages appear legitimate at first glance, but their module-loading behavior secretly launches the RedShell Linux implant. Once active, the implant provides attackers with remote shell access, credential and data collection, persistence, network pivoting, and other post-exploitation capabilities.
The addition of Red Agent, an LLM-powered command execution component, further demonstrates how AI can lower the operational barrier for attackers by translating natural-language objectives into complex offensive commands.
For developers, the incident is another reminder that trusting a package simply because it works as advertised is no longer sufficient. Dependencies need to be continuously monitored for unexpected code execution, new binaries, suspicious network activity, and changes in package behavior
