14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process. No install hook function call is needed — a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.

TL;DR

• Threat type: Trojanized npm packages delivering an AI-powered Linux backdoor through module import
• Ecosystem: npm
• Payload: RedShell — the Linux beacon for the RedC2 4.0 command-and-control framework
• Defining tell: No install hook or exported function call is needed; a single import anywhere in the dependency graph triggers execution
• Novelty: Red Agent, an LLM-driven component, lets operators orchestrate complex post-exploitation tasks using natural language commands

The 14 Trojanized Packages

The packages are presented as small, dependency-free utilities for calendar and streak calculations. What makes them notable is that they are functional — they offer the promised functionality and the date helpers work exactly as documented. But beneath that garb of date utilities is code designed to drop a Linux backdoor.

How the Trojan Loader Works

Delivery is handled by the package entry file, dist/index.mjs, which acts as a trojan loader. It re-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function required. As security researcher Aliakbar Zahravi from TrendAI explained, the loader re-exports the date helpers so consumers import them under the package name, while everything else in the file is an initialization routine that no exported function reaches.

The critical implication is that --ignore-scripts and similar controls that assume malicious npm behavior lives in lifecycle hooks provide no coverage here. A single import anywhere in the dependency graph — including from a transitive dependency the developer never selected — is sufficient to trigger the payload.

The Bundled Payload: RedShell

Each package ships a Linux ELF binary framed in the source as a native math accelerator. The filename varies across the cluster:

math-core.bin
math-calc.bin
calc-math.dat
calc-cache.bin
calc.bin
calc-mapping.bin

The file sits either directly within dist/ or under dist/internal/, but despite the varied names and locations, the contents are identical in every case: the RedShell Linux beacon for RedC2 4.0. This beacon communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.

RedC2 4.0: A Cross-Platform C2 Framework

RedC2 4.0 is marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux, offering surveillance, credential theft, payload loading, and mass-operation capabilities. The version was advertised by a threat actor named "MarlboroMan" on Hack Forums in early June 2026, describing it as a command-and-control (C2 or C&C) framework "built for evasion."

The framework has been under active development for at least a year:

On a clearnet website branded Red Offsec, the threat actor describes the framework as follows: "Red C2 is a multi-language, multi-OS command and control framework designed for Windows, Linux, and macOS. The entire framework was built with evasion as a core principle, utilizing the latest developments and techniques in offensive security field." It is available for purchase for $99.99.

C2 Framework Capabilities

The C2 framework is feature-rich, supporting a broad range of operational capabilities:

• Terminal access
• File transfer
• Staged payload delivery
• Data collection
• Multi-beacon operation
• Network visualization
• Host-to-host tunneling
• In-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode

RedC2 also extends its control layer with a command-line extension referred to as RedC2 EXT.

Linux Beacon: RedShell Capabilities

Once deployed, the Linux variant of the beacon provides an interactive shell through /bin/sh and exposes Linux-specific commands to enable:

• System discovery
• File operations
• Data collection, including SSH keys and browser credentials
• Execution
• Persistence
• In-memory ELF execution
• SOCKS5 proxying
• Network pivoting

The beacon establishes communication with a C2 server and registers the infected system by gathering basic system information and transmitting it in the form of a "check-in message." After that, it enters a command-processing loop to process incoming instructions from the operator, execute them via /bin/sh, and send the results back.

Windows and macOS Counterparts

The Windows and macOS counterparts of the beacon cover similar ground, allowing file operations, host and network reconnaissance, user enumeration, and data harvesting. The Windows beacon additionally incorporates capabilities that the macOS version lacks:

• User Account Control (UAC) bypass
• Antivirus and endpoint detection
• Antivirus tampering
• In-memory execution
• Lateral movement

Red Agent: AI-Assisted Command Execution

What sets RedC2 apart is its integration of AI directly into the offensive workflow. RedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into framework beacon commands. This lets operators orchestrate complex post-exploitation tasks — such as network reconnaissance and credential dumping — using natural language commands.

Red Offsec has characterized Red Agent as "an AI-powered command execution system specialized for penetration testing." As TrendAI noted, by interacting with a model tuned for red-team operations, an operator inputs natural-language prompts and the framework translates them into actionable command sequences. This abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently.

The findings underscore how previously undocumented AI-integrated C2 frameworks are being distributed via malicious npm packages, while simultaneously lowering the barrier to entry for operators of varying skill levels.

Indicators of Compromise

Malicious packages

npm/streak-metrics-math@1.0.0
npm/streak-metrics-math@1.0.1
npm/kit-map-vim@1.0.0
npm/streak-map-cache@1.0.0
npm/streak-map-kit@1.0.0
npm/map-streak-kit@1.0.0
npm/streak-cache-map@1.0.0
npm/streak-calc-metrics@1.0.0
npm/streak-calc-math@1.0.0
npm/streak-math-abz@1.0.0
npm/streak-metricsaz@1.0.0
npm/streak-math-metrics@1.0.0
npm/streak-metricazbd@1.0.0
npm/streak-metricsazb@1.0.0
npm/streak-kit-map@1.0.0

Dropped payload filenames

math-core.bin
math-calc.bin
calc-math.dat
calc-cache.bin
calc.bin
calc-mapping.bin

Each file resolves to the same artifact: the RedShell Linux beacon for RedC2 4.0, located either directly in dist/ or under dist/internal/.

Trojan loader

dist/index.mjs  — re-exports date helpers, launches bundled implant at module load
No install hook required; fires on import anywhere in the dependency graph