14 Trojanized npm Packages Deliver RedC2 4.0 AI-Powered Linux Backdoor

Cybersecurity researchers have uncovered 14 trojanized npm packages that masquerade as legitimate calendar, streak, mapping, and utility modules but secretly deliver an AI-powered Linux backdoor associated with the RedC2 4.0 command-and-control framework.

According to TrendAI, Trend Micro's enterprise cybersecurity research division, the malicious packages are designed to appear functional and provide the utilities advertised by their names. However, they also contain a hidden native binary that acts as the RedShell Linux beacon, allowing attackers to establish remote control over compromised systems.

The attack is particularly notable because the malware does not rely on an npm installation hook. Instead, the malicious code executes when the affected module is imported, meaning that even a transitive dependency somewhere in an application's dependency tree can be enough to trigger the payload.

"No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload."

Malicious npm Packages Identified

Researchers identified the following packages and versions:

The packages are designed to look like ordinary JavaScript utilities associated with dates, streak calculations, mapping, and mathematical operations.

However, hidden inside their distribution files is a malicious native executable disguised as a math-related component.

Malware Disguised as a Native Math Component

The malicious binaries use different filenames depending on the package, including:

  • math-core.bin
  • math-calc.bin
  • calc-math.dat
  • calc-cache.bin
  • calc.bin
  • calc-mapping.bin

The files are stored either directly inside the package's dist/ directory or under dist/internal/.

Despite the different names, researchers determined that the binaries ultimately contain the RedShell Linux beacon, the Linux component associated with RedC2 4.0.

The malicious package entry point, dist/index.mjs, acts as a trojanized loader. It continues to expose the legitimate date-related functionality while simultaneously launching the hidden implant when the module is loaded.

This means developers do not necessarily need to explicitly execute a suspicious function for the malware to run.

Importing the Package Can Trigger the Malware

The infection mechanism is one of the most important aspects of the campaign.

Rather than depending on a traditional npm preinstall or postinstall script, the malicious package uses its JavaScript entry point to launch the bundled binary.

As a result, the attack can trigger when an application simply imports the compromised package.

This also creates a risk through transitive dependencies.

For example, if:

Application → Package A → Package B → Malicious npm Package

and Package B imports the compromised module, the RedShell implant may be launched even if the application's developers never knowingly selected the malicious package themselves.

Security researcher Aliakbar Zahravi described dist/index.mjs as the delivery mechanism because it both re-exports the legitimate functionality and launches the bundled implant.

RedC2 4.0 Linux Implant

The malware delivered by these packages is associated with RedC2 4.0, a cross-platform command-and-control framework marketed as an offensive security and red-team toolkit.

RedC2 supports Windows, Linux and macOS.

Version 4.0 was advertised in early June 2026 by a threat actor using the name "MarlboroMan" on Hack Forums.

Earlier versions of the framework included RedC2 2.0 in August 2025 and RedC2 3.0 in January 2026.

The Linux-specific RedShell beacon was introduced with version 4.0.

The framework provides operators with capabilities including:

  • Remote terminal access
  • File transfer
  • Payload delivery
  • Data collection
  • Multiple beacon management
  • Network visualization
  • Host-to-host tunneling
  • In-memory execution
  • Beacon Object File execution
  • .NET assembly execution
  • Shellcode execution

RedShell Linux Capabilities

Once deployed, RedShell provides attackers with an interactive shell through /bin/sh.

The Linux beacon can perform system discovery, file operations, information collection, persistence and remote command execution.

Researchers said the malware can also collect sensitive information such as:

  • SSH keys
  • Browser credentials
  • System information
  • User information
  • Network information
  • Files stored on the compromised machine

The malware also supports in-memory ELF execution, allowing attackers to execute additional Linux binaries without necessarily dropping them to disk in the traditional manner.

Another capability is SOCKS5 proxying, which can enable attackers to route traffic through compromised systems and use them for network pivoting.

Command-and-Control Communication

After infection, the RedShell beacon establishes communication with its command-and-control infrastructure.

During its initial check-in, the compromised machine sends basic system information to the operator.

The beacon then enters a command-processing loop.

Commands received from the C2 server are executed through /bin/sh, with the resulting output returned to the attacker.

This effectively gives the operator remote shell access to the infected Linux host.

RedC2 Is an AI-Enabled Offensive Framework

One of the most notable characteristics of RedC2 4.0 is its integration with artificial intelligence.

The framework includes a component called Red Agent, an LLM-powered command execution layer designed to translate natural-language instructions into RedC2 beacon commands.

Instead of manually constructing every individual command, an operator can provide a higher-level objective and have the AI component help translate that intent into executable actions within the framework.

According to TrendAI, this can lower the technical barrier for operators attempting to conduct complex post-exploitation activity.

Potential operations include network reconnaissance, credential collection and other post-compromise activities.

Red Agent and Automated Post-Exploitation

Red Agent is described as an AI assistant designed specifically around red-team and offensive-security operations.

The system can transform natural-language instructions into command sequences that can then be executed through RedC2's beacon infrastructure.

This creates a significant concern when the framework is distributed through malicious software packages.

An attacker does not necessarily need to manually develop every component of an intrusion. Instead, the combination of a ready-made C2 framework, malware beacons and an LLM-assisted command layer can streamline multiple stages of an attack.

Cross-Platform Capabilities

Although the npm campaign specifically delivers the Linux RedShell component, RedC2 itself supports multiple operating systems.

The Windows and macOS variants provide capabilities including:

  • File operations
  • Host reconnaissance
  • Network reconnaissance
  • User enumeration
  • Data collection
  • Payload execution

The Windows beacon contains additional capabilities, including User Account Control bypass, antivirus and endpoint detection, security-tool tampering, in-memory execution and lateral-movement functionality.

Some of those Windows-specific capabilities are not present in the macOS version.

RedC2 Marketed as an Evasion-Focused Framework

RedC2 is marketed through a website branded Red Offsec as a multi-language and multi-operating-system command-and-control framework.

The developers describe evasion as one of the core design principles of the platform.

The framework is reportedly offered for approximately $99.99.

Red Offsec's terms of service state that customers are prohibited from using the platform for unauthorized access, hacking without permission or exploitation of systems they do not own or have authorization to test.

However, researchers' discovery of RedC2 components inside malicious npm packages demonstrates how legitimate offensive-security tooling can be repurposed as part of real-world supply-chain attacks.

Why the npm Attack Is Significant

The campaign demonstrates a dangerous combination of software supply-chain abuse and modern offensive tooling.

Developers commonly rely on large numbers of open-source npm dependencies. A package can be introduced directly by a developer or indirectly through another dependency.

Because the malicious packages retain their expected functionality, a quick functional test may not immediately reveal that something is wrong.

The malware is also not dependent on a traditional npm lifecycle installation script.

Instead, execution occurs when the JavaScript module is loaded.

That approach can potentially evade security controls and developer assumptions that focus primarily on suspicious install scripts.

Supply-Chain Attacks Continue Across Package Ecosystems

The RedC2 campaign comes shortly after another major software supply-chain incident involving the Rust ecosystem.

In that incident, malicious versions of the legitimate Rust crates:

were published after a maintainer account was believed to have been compromised.

Those releases introduced a malicious dependency named proc-macro1, a typosquat of the legitimate proc-macro2 package.

The dependency's build script automatically executed malware during compilation.

The incident demonstrated that attackers continue to target developer ecosystems where malicious code can reach large numbers of downstream applications through trusted dependency relationships.

Possible Connection to Broader Supply-Chain Activity

Researchers have also highlighted infrastructure overlaps between the Rust supply-chain attack and previous compromises involving software projects such as Mastra and Axios.

Those earlier incidents have been associated with North Korean threat activity.

However, the information provided in the research does not establish that the RedC2 npm campaign was conducted by the same threat actor.

The connection is primarily relevant because it demonstrates the continuing use of software-package ecosystems as an avenue for distributing malware.

What Developers Should Watch For

Organizations using npm should pay particular attention to dependencies that contain native binaries despite presenting themselves as simple JavaScript utilities.

Security teams should review:

  • Newly added npm dependencies
  • Unexpected native binaries inside packages
  • Suspicious files inside dist/ directories
  • Package entry points that execute binaries during import
  • Unexpected child processes launched by Node.js
  • Network connections created immediately after importing a module
  • Unexpected shell execution from Node.js processes
  • Changes to package versions or maintainers
  • Dependencies introduced indirectly through transitive packages

Organizations should also maintain software bills of materials and use dependency-locking mechanisms to make unexpected package changes easier to detect.

The Bigger Security Concern

The campaign highlights how modern software supply-chain attacks are evolving.

Attackers are no longer limited to inserting obvious malicious installation scripts. A malicious package can maintain its advertised functionality while quietly embedding a native payload that executes during normal application behavior.

At the same time, commercially available C2 frameworks such as RedC2 increasingly incorporate AI capabilities that can help automate reconnaissance and post-exploitation tasks.

The combination creates a potentially powerful attack chain:

Malicious npm package → Hidden native binary → RedShell Linux beacon → RedC2 infrastructure → AI-assisted post-exploitation

For developers and security teams, the incident reinforces the importance of treating third-party dependencies as part of the application's attack surface rather than assuming that packages available through public repositories are automatically trustworthy.