# 14 Trojanized npm Packages Deliver RedC2 4.0 Linux Backdoor AI-assisted command and control framework hidden in calendar utilities. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-21 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8dcb3fe7-eb60-47c8-bccb-2a8a6f8b8203 ## Malicious npm Packages Discovered TrendAI researchers identified 14 trojanized npm packages masquerading as calendar utilities that deploy the RedC2 4.0 Linux backdoor. The packages conceal binaries under names like 'math-core.bin'. When loaded, these binaries automatically execute in the background, initiating intrusion activities without requiring installation hooks. ## Stealthy Delivery Mechanism The malicious code resides in packages' 'dist/' directories. The 'dist/index.mjs' file serves dual purposes - executing legitimate functions while simultaneously triggering the backdoor. This hookless activation means any import in the dependency graph, even transitive ones, can compromise systems. Developers might unknowingly execute malicious code through normal workflows. ## RedC2 4.0 Capabilities Priced at $99.99 on cybercrime forums, RedC2 4.0 is a cross-platform C2 framework supporting Windows, macOS and Linux. It offers advanced features including terminal access, file transfer, staged payload delivery, and in-memory code execution. The Linux version specifically targets SSH keys and browser credentials with optimized harvesting tools. ## AI-Powered Command System The LLM-based Red Agent component translates natural language commands into framework operations. Phrases like 'list all Windows machines on network' automatically convert to beacon commands. This abstraction lowers the skill barrier, enabling less technical attackers to conduct sophisticated post-exploitation activities. ## Active Development Timeline RedC2 version 2.0 launched August 2025, followed by 3.0 in January 2026. The June 2026 4.0 release by threat actor 'MarlboroMan' introduced Linux beacon support and AI integration. The framework emphasizes evasion-centric design, incorporating latest offensive security techniques according to its clearnet marketing. ## Windows vs macOS Impact The Windows variant includes UAC bypass, AV evasion, and lateral movement capabilities absent in macOS. Both versions perform file operations and network reconnaissance, exfiltrating harvested data to C2 servers. The Linux beacon provides interactive shell access through '/bin/sh' with specialized commands for system exploration. ## Legal Facade Maintenance The Red Offsec clearnet site claims the tool is designed solely for authorized penetration testing. While terms prohibit unauthorized access, security experts warn such tools frequently get weaponized. TrendAI's report highlights growing abuse of popular platforms like npm for malware distribution. ## Software Supply Chain Risks This incident follows recent supply chain attacks against Rust crates. Malicious dependencies exploiting automated build processes reveal critical vulnerabilities in open-source ecosystems. Security professionals advocate stricter vetting mechanisms for package managers to prevent similar compromises. ## Sources covering this story - https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._