14 Trojanized npm Packages Deploy RedC2 4.0 Linux Backdoor with AI-Assisted Command and Control

Researchers at TrendAI (Trend Micro's enterprise security unit) have identified 14 malicious npm packages that deliver the RedC2 4.0 Linux backdoor — a commercially sold crimeware framework that now ships with an AI assistant capable of translating natural-language operator commands into multi-stage intrusion sequences. The packages masquerade as calendar and streak utility libraries, function as advertised to avoid detection, and require only a single import statement to trigger the backdoor installation.

The Trojanized Packages

All 14 packages share a naming pattern built around "streak," "map," "kit," "calc," and "metrics" — designed to appear as plausible developer utilities. Identified package names include:

• streak-metrics-math (versions 1.0.0, 1.0.1)
• kit-map-vim
• streak-map-cache
• streak-map-kit
• map-streak-kit
• streak-cache-map
• streak-calc-metrics
• streak-calc-math
• streak-math-abz
• streak-metricsaz
• streak-math-metrics

The packages are fully functional — they provide the promised date calculation and streak-tracking utilities, making static and casual inspection less likely to surface the malicious component. The trojan code lives in dist/index.mjs, which re-exports legitimate helper functions while simultaneously launching a bundled malicious binary as a detached background process. No install hook (postinstall, preinstall) is used; a single import anywhere in the dependency graph — including transitive dependencies — triggers execution on Linux systems.

Malicious binary files are embedded under names like math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, and calc-mapping.bin, disguised as native math accelerators.

What Is RedC2 4.0?

RedC2 is a commercial command-and-control framework sold on cybercrime forums and via a clearnet site branded "Red Offsec" by a threat actor using the alias "MarlboroMan," priced at $99.99. It supports Windows, macOS, and Linux, with evasion designed as a core feature. Capabilities include surveillance, credential theft, payload loading, and mass-operation support. Version history:

The v4.0 release adds the RedShell Linux beacon — the component deployed by these npm packages.

AI-Assisted Command and Control

The defining new feature of RedC2 4.0 is Red Agent, an embedded LLM-backed command execution layer. An operator types a plain-English intent — for example, "exfiltrate credentials from this host" — and Red Agent translates it into the specific multi-stage command sequences the C2 framework executes on connected beacons. The practical consequence is significant: it dramatically lowers the skill barrier for operating complex intrusions, allowing less technically sophisticated threat actors to run campaigns that previously required deep expertise in offensive tooling.

Who Is Targeted

The packages targeted software developers — specifically anyone who imports one of the named packages on a Linux system, whether directly or as a transitive dependency pulled in by another library. Development environments, CI/CD pipelines, and build servers running Linux are all at risk.

Detection and Mitigation

Immediate actions if you use any of the named packages:

1. Audit your package.json and lock files for any of the listed package names
2. Remove matching packages immediately and regenerate your lock file
3. Inspect affected systems for the binary filenames: math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin
4. Treat any host that imported these packages as fully backdoored — rotate all credentials, review persistence mechanisms, audit for lateral movement

Ongoing controls:

5. Run npm audit and integrate it into CI pipelines — this won't catch all supply chain attacks, but provides a baseline
6. Vet new transitive dependencies before they enter production builds, particularly new or low-download packages with recent publication dates
7. Monitor for unexpected child processes spawned during application startup — a detached background process at import time is a strong indicator of supply chain compromise
8. Consider lockfile pinning and integrity checks (e.g., package-lock.json with npm ci) to prevent unexpected dependency updates from introducing malicious versions

The Broader Picture

This campaign follows a pattern of npm supply chain attacks that has accelerated through 2025 and 2026 — using functional packages to lower detection probability, bundling malicious payloads as innocuous-sounding binary assets, and avoiding install hooks that security tools commonly flag. The addition of an AI-driven C2 layer to a $99.99 commodity kit signals that the tooling advantage attackers gain from AI is no longer hypothetical — it is being productized and sold to low-sophistication actors at accessible price points.

For security teams, this reinforces the case for treating every new dependency as an attack surface and implementing automated scanning for unusual binary files in node_modules trees.