14 Trojanized npm Packages Deliver RedC2 4.0 Linux Backdoor
AI-assisted command and control framework hidden in calendar utilities.
1Malicious npm Packages Discovered
TrendAI researchers identified 14 trojanized npm packages masquerading as calendar utilities that deploy the RedC2 4.0 Linux backdoor. The packages conceal binaries under names like 'math-core.bin'. When loaded, these binaries automatically execute in the background, initiating intrusion activities without requiring installation hooks.
2Stealthy Delivery Mechanism
The malicious code resides in packages' 'dist/' directories. The 'dist/index.mjs' file serves dual purposes - executing legitimate functions while simultaneously triggering the backdoor. This hookless activation means any import in the dependency graph, even transitive ones, can compromise systems. Developers might unknowingly execute malicious code through normal workflows.
3RedC2 4.0 Capabilities
Priced at $99.99 on cybercrime forums, RedC2 4.0 is a cross-platform C2 framework supporting Windows, macOS and Linux. It offers advanced features including terminal access, file transfer, staged payload delivery, and in-memory code execution. The Linux version specifically targets SSH keys and browser credentials with optimized harvesting tools.
4AI-Powered Command System
The LLM-based Red Agent component translates natural language commands into framework operations. Phrases like 'list all Windows machines on network' automatically convert to beacon commands. This abstraction lowers the skill barrier, enabling less technical attackers to conduct sophisticated post-exploitation activities.
5Active Development Timeline
RedC2 version 2.0 launched August 2025, followed by 3.0 in January 2026. The June 2026 4.0 release by threat actor 'MarlboroMan' introduced Linux beacon support and AI integration. The framework emphasizes evasion-centric design, incorporating latest offensive security techniques according to its clearnet marketing.
6Windows vs macOS Impact
The Windows variant includes UAC bypass, AV evasion, and lateral movement capabilities absent in macOS. Both versions perform file operations and network reconnaissance, exfiltrating harvested data to C2 servers. The Linux beacon provides interactive shell access through '/bin/sh' with specialized commands for system exploration.
7Legal Facade Maintenance
The Red Offsec clearnet site claims the tool is designed solely for authorized penetration testing. While terms prohibit unauthorized access, security experts warn such tools frequently get weaponized. TrendAI's report highlights growing abuse of popular platforms like npm for malware distribution.
8Software Supply Chain Risks
This incident follows recent supply chain attacks against Rust crates. Malicious dependencies exploiting automated build processes reveal critical vulnerabilities in open-source ecosystems. Security professionals advocate stricter vetting mechanisms for package managers to prevent similar compromises.
Original article: The Hacker News — 14 Sahte npm Paketi RedC2 4.0 Linux Backdoor'u Yayıyor