Trojanized npm Packages Distribute RedC2 4.0 Linux Backdoor Across Systems

In an investigation uncovered by cybersecurity researchers, 14 trojanized NPM packages have been masquerading as legitimate calendar modules and utility modules while secretly delivering a Linux backdoor powered by artificial intelligence (AI) known as RedC2 4.0. 

Upon importation of the malicious packages, TrendAI, Trend Micro's enterprise cybersecurity company, explains that they execute the payload bundled with the module without any installation hooks required. In the code, the embedded binary is located, permissions are changed to make it executable, and it is then launched as a detached background process. 

As a result, even a transitive dependency can trigger the backdoor when a compromised package is loaded. It is concealed under filenames such as math-core.bin and calc-math.dat that the malicious payload is concealed in order to prevent raising suspicion. Through the embedded Linux beacon, attackers are able to communicate with remote infrastructure and gain access to affected systems to conduct further malicious activities. 

RedC2 4.0 has been actively developed with capabilities extending beyond basic remote access. Along with interactive shell access and system reconnaissance, its Linux component facilitates data collection, including the theft of sensitive information such as SSH keys, through its Linux component. The comprehensive framework also encompasses file transfer, network visualization, host-to-host tunneling, and in-memory payload execution, highlighting the growing threat posed by malicious software packages. 

Malicious Packages Retain Legitimate Functionality

In spite of the fact that the compromised packages do not appear to be obviously malicious, they continue to provide the calendar and date-related functions described in their package descriptions. The malicious code, however, is concealed within the package structure, in which files such as math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin and calc-mapping.bin are listed as native components. 

There are two types of files stored within the dist/ directory: either directly under the dist/ directory or in dist/internal/ directory. Even though the names of these packages differ, they contain the RedShell Linux beacon that is associated with RedC2 4.0. The package entry file, dist/index.mjs, serves as a loader. It re-exports the valid date utilities while simultaneously initiating the embedded implant. By doing so, the malicious component does not require an installation hook or specific function call to execute. 

RedShell Gives Attackers Remote Access

RedShell beacons establish communication with remote command-and-control servers once they become active and register compromised systems. Prior to entering a command-processing LO, they collect basic information about the host. 

Through /bin/sh, the Linux beacon provides an interactive shell and allows for a wide range of system operations, including system discovery, file management, collection of data, and execution of commands. This implant also has the capability of searching for sensitive information, including SSH keys and browser credentials. In addition to persistence and in-memory ELF execution, it also supports SOCKS5 proxying. 

The network pivoting capabilities further enable an attacker to use compromised systems as an entry point into other environments. This version of RedC2 4.0 also provides similar features across macOS and Windows. The framework provides file operations, host and network reconnaissance, enumeration of users, and data collection. 

The Windows component also offers capabilities such as bypassing UAC, tampering with security tools, and lateral movement. 

RedC2 Framework Adds AI Assisted Operations

For Windows, Linux, and Mac OS, RedC2 4.0 is presented as a cross-platform command-and-control framework. As of August 2025, the framework has been actively developing, with version 3.0 appearing in January 2026 and version 4.0 released in June. In addition to the RedShell Linux beacon, the latest version offers a comprehensive set of post-exploitation functionality. 

There are several features in this framework, including access to terminals, file transfers, staged payload delivery, multi-beacon management, network visualisation, host-to-host tunnelling, and execution of BOFs, .NET assemblies and shellcode in memory. 

As an important addition, Red Agent is an artificial intelligence-assisted component with a large language model. It allows operators to describe tasks in natural language and have these instructions translated into beacon commands by the framework. By incorporating this feature, operations such as network reconnaissance and credential collection can be simplified. Moreover, it decreases the technical knowledge required to operate more complex framework functions. 

Supply Chain Risks Extend Beyond npm

A wider pattern of attacks is being observed against software ecosystems as a result of the incident. In recent years, development teams have increasingly relied on third-party packages, which often include binaries and transitive dependencies that are not visible to developers. 

A package can appear useful and maintain normal behavior while carrying a separate native payload even though it has legitimate functionality present, making it particularly difficult to detect such attacks during routine code reviews. As part of the RedC2 campaign, three legitimate Rust crates were also subjected to a recent supply chain attack. These packages have been modified in order to include a malicious dependency capable of executing malware during cargo builds. 

In addition to targeting multiple development ecosystems rather than focusing exclusively on NPM, the incidents reinforced the need for tighter dependency controls for development and infrastructure teams. When possible, it is recommended that package versions be pinned and dependencies and embedded binaries be reviewed before entering production environments. 

It is possible to detect suspicious activity by monitoring unexpected process creation and outbound network connections from build systems. As the number of malicious packages carrying backdoors continues to increase, software supply chains continue to be an important entry point for malicious entities. By including AI-assisted functionality to frameworks such as RedC2, operational capabilities are further improved following an initial compromise.