14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Summary

Cybersecurity researchers at TrendAI (Trend Micro's enterprise business) discovered 14 trojanized npm packages posing as functional calendar and streak/date utilities that covertly deliver an AI-powered Linux implant dubbed RedC2 4.0. The packages provide their advertised functionality while dropping a bundled binary disguised as a native math accelerator.^[0]

The malicious payload executes automatically: when the module loads, the entry file dist/index.mjs locates the bundled binary, marks it executable, and launches it as a detached background process, with no install hook required. A single import anywhere in the dependency graph—even a transitive one—is enough to run the implant.^[0]

The dropped binary is the RedShell Linux beacon for RedC2 4.0, a cross-platform C2 framework advertised by a threat actor named MarlboroMan on Hack Forums in early June 2026 and sold via a clearnet Red Offsec site for $99.99. The framework notably includes an LLM-backed assistant called Red Agent that converts natural-language intent into beacon commands, lowering the barrier to entry for multi-stage intrusions.^[0]

Attack chain

1. Initial delivery: Trojanized npm packages masquerading as working calendar/streak/date utilities are published to the npm registry, offering genuine functionality to disguise the malicious payload.^[0]
2. Execution on import: The package entry file dist/index.mjs acts as a trojan loader that re-exports date helpers and, on module load, locates the bundled binary (disguised as a math accelerator), marks it executable, and launches it as a detached background process—no install hook or exported function call is required, and a transitive import suffices.^[0]
3. Implant deployment: The bundled binary is the RedShell Linux beacon for RedC2 4.0, dropped from dist/ or dist/internal/ under names such as math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin.^[0]
4. Check-in and C2: The RedShell beacon establishes communication with a remote Windows or Linux C2 server, registers the host by gathering basic system information into a check-in message, then enters a command-processing loop executing operator instructions via /bin/sh and returning results.^[0]
5. Post-exploitation: The Linux beacon exposes an interactive /bin/sh shell and commands for system discovery, file operations, data collection (SSH keys, browser credentials), persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting, optionally orchestrated through the Red Agent LLM assistant.^[0]

Disclosure timeline

Actor profile

MarlboroMan

Threat actor who advertised RedC2 4.0 on Hack Forums in early June 2026, describing the framework as a cross-platform (Windows, macOS, Linux) C2 toolkit 'built for evasion.' The tool is also marketed on a clearnet website branded Red Offsec for $99.99, whose Terms of Service nominally prohibit unauthorized access while positioning the tool for red-team professionals. RedC2 has been under active development for at least a year across versions 2.0 (Aug 2025), 3.0 (Jan 2026), and 4.0.^[0]

How it works

Rather than exploiting a software vulnerability, the campaign abuses npm module-loading behavior: the entry file dist/index.mjs re-exports legitimate date helpers and, on import, locates a bundled binary, chmods it executable, and spawns it as a detached background process. Because execution triggers on any import—including transitive dependencies—no npm install hook or exported function invocation is needed to run the payload.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• npm packages can weaponize module-load behavior so a single import—even a transitive one—executes a bundled backdoor with no install hook, making dependency hygiene and behavioral monitoring critical.^[0]
• RedC2 4.0 represents a maturing commodity C2 ecosystem: cross-platform, sold cheaply ($99.99), under active year-long development, and now shipping an LLM assistant (Red Agent) that lowers the skill barrier for complex multi-stage intrusions.^[0]

Defensive actions

• Remove and block the 14 identified trojanized npm packages across development and build environments.: These packages execute the RedC2 4.0 RedShell backdoor on any import, including transitive dependencies, so their mere presence in a dependency graph compromises the host.^[0]
• Hunt for suspicious bundled binaries (math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin) under dist/ or dist/internal/ directories and detached processes launched from npm modules.: The loader marks these binaries executable and launches them as detached background processes disguised as native math accelerators.^[0]
• Monitor Linux hosts for RedShell beacon behavior: unexpected /bin/sh interactive sessions, SSH key and browser-credential access, SOCKS5 proxying, and outbound C2 check-in traffic.: The RedShell Linux beacon registers infected systems via a check-in message and enters a command loop supporting data collection, persistence, and network pivoting.^[0]