Cybersecurity researchers have uncovered trojanized npm packages that masquerade as everyday calendar and streak-related utilities. While the packages provide the functions users expect, they also contain code engineered to quietly deploy a Linux backdoor called RedC2 4.0.
What makes the discovery especially concerning is how the payload is triggered. Researchers report that merely importing the module—potentially even through a transitive dependency—can be enough to execute the malicious logic as soon as the package is loaded.
What researchers found in the npm packages
The identified malicious packages present themselves as legitimate tooling for date calculations, streak metrics, and cached mappings. According to the report, these packages behave like real utilities on the surface, which can reduce suspicion during casual testing.
Below are the package names researchers linked to the activity:
- streak-metrics-math@1.0.0, 1.0.1
- kit-map-vim@1.0.0
- streak-map-cache@1.0.0
- streak-map-kit@1.0.0
- map-streak-kit@1.0.0
- streak-cache-map@1.0.0
- streak-calc-metrics@1.0.0
- streak-calc-math@1.0.0
- streak-math-abz@1.0.0
- streak-metricsaz@1.0.0
- streak-math-metrics@1.0.0
- streak-metricazbd@1.0.0
- streak-metricsazb@1.0.0
- streak-kit-map@1.0.0
Despite their benign “date utility” purpose, the packages are designed to deliver a Linux implant. Researchers note that the embedded file names vary between packages—examples include math-core.bin, math-calc.bin, calc-math.dat, and several others.
How RedC2 4.0 gets delivered
Each trojanized package carries an embedded binary or data file placed either directly in dist/ or inside dist/internal/. While the filename changes, the contents are described as consistent: a Linux beacon associated with RedC2 4.0.
Delivery is orchestrated by an entry file in the package distribution, specifically dist/index.mjs. Researchers describe it as a trojan loader that re-exports the expected date helper functions and launches the implant when the module loads.
Crucially, the report emphasizes that there is no need for an install hook call. Instead, a single import anywhere in the dependency graph—again, including transitive dependencies—can trigger execution. In practical terms, this means developers may be exposed even if they never explicitly use the malicious package’s “main” functionality.
Why this approach is hard to catch
Many teams focus on what happens during installation. In this case, the malicious behavior occurs at load time, not through a traditional install-time hook. That shifts the detection challenge to build pipelines, runtime module loading, and dependency review processes.
Additionally, the malicious packages offer the promised behavior. That combination—functional output plus hidden execution—can make it easier to miss during testing, especially when code review doesn’t inspect every distributed artifact under dist/.
What RedC2 4.0 can do on Linux
Once deployed, the Linux beacon is designed to blend into a compromised environment and provide interactive control to an operator. Researchers report that it exposes an interactive shell via /bin/sh and implements Linux-specific commands for system discovery and follow-on actions.
According to the findings, the implant can:
- Gather system and host information during a “check-in” stage
- Establish a command-processing loop to handle incoming instructions
- Execute commands using /bin/sh and return results
- Perform file operations and staged payload delivery
- Collect sensitive data such as SSH keys and browser credentials
- Support persistence and enable system interaction
- Enable in-memory execution of ELF payloads
- Provide SOCKS5 proxying and network pivoting capabilities
Beyond the Linux-specific capabilities, the RedC2 platform is described as a cross-platform command-and-control framework. The Linux component communicates with a remote server to coordinate post-exploitation activities on the infected host.
RedC2’s broader control features
The framework behind the attack is not limited to simple remote command execution. Researchers describe a feature-rich control layer that supports multiple forms of interaction and operator workflows.
Reported C2 capabilities include terminal access, file transfer, data collection, multi-beacon operations, network visualization, host-to-host tunneling, and in-memory execution of additional payload formats. While some features vary by operating system, the platform’s intent is consistent: maintain control and tasking while reducing friction for attackers.
The report also notes that Windows and macOS variants cover similar categories such as reconnaissance, user enumeration, and data harvesting. The Windows beacon includes additional elements such as UAC bypass behavior and antivirus-related tampering, which the macOS version reportedly lacks.
AI-assisted operation and natural-language command execution
A notable aspect of RedC2 4.0 is how the platform positions its operator experience. Researchers report that Red Offsec markets an AI-driven component called Red Agent, described as an LLM-backed command execution layer.
In the account from the researchers, the concept is that operators provide natural-language intent and the system translates it into concrete beacon commands. The report frames this as “AI-powered command execution” intended for penetration testing workflows.
As described in the findings, this abstraction can make complex, multi-step intrusions easier to carry out—particularly for operators with varying levels of technical expertise.
Market availability and stated restrictions
The report describes a clearnet website branded as Red Offsec where RedC2 is offered for purchase. Terms of service prohibit use for unauthorized computer access, hacking without explicit permission, and abuse or damage of systems the customer does not own or have authorization to test.
Even with these stated restrictions, the discovery demonstrates a common real-world pattern: tools marketed for legitimate security work can be repurposed when distribution channels are abused and malicious packages are introduced into software ecosystems.
Context: supply chain abuse continues to evolve
This npm-related finding appears alongside other supply chain activity. The report references a coordinated attack affecting several legitimate Rust crates where a malicious proc-macro dependency executed cross-platform malware during Cargo builds. That incident, like the npm case, reinforces the idea that attackers increasingly target common build and dependency mechanisms.
In both scenarios, the barrier to entry can drop for attackers: instead of crafting one-off malware installers, adversaries can piggyback on dependency workflows that developers already rely on.
How to reduce risk from trojanized npm packages
If your projects pull npm dependencies, you can reduce exposure by tightening how dependencies are fetched and validated. While no single measure eliminates risk, layered controls make it harder for malicious modules to execute unnoticed.
- Pin versions and verify provenance: Prefer lockfiles and consider provenance/signature validation when available in your pipeline.
- Scan both source and build outputs: Don’t stop at package metadata—inspect suspicious binaries in dist/ folders and review unexpected payload artifacts.
- Watch for load-time execution: Review dependency code for patterns that run during import, not just those triggered during installation.
- Limit what runs in production: Use least-privilege and restrict filesystem/network access for build and runtime environments.
- Use security tooling and alerting: Combine dependency scanning with runtime monitoring to catch unexpected process launches.
Finally, encourage developers to treat “small” utilities with the same scrutiny as core dependencies—especially when they are transitive, because that is where this attack method can hide.
Conclusion
The discovery of trojanized npm packages that deliver RedC2 4.0 highlights how supply chain attacks can be both subtle and effective. By combining functional-looking utilities with load-time payload execution, the packages can trigger malware through a simple import—sometimes far removed from the developer’s direct code.
As command-and-control platforms add AI-assisted orchestration, the operational advantage for attackers grows. That makes dependency hygiene, artifact inspection, and load-time behavior review more important than ever for teams building and shipping JavaScript software.
Source: https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html
