"When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's enterprise cybersecurity business, wrote in its report. The deceptively simple behavior turns innocuous-looking npm utilities into automatic droppers for an AI-enabled Linux backdoor.
The trojanized npm packages and what they hide
Security researchers identified 14 npm packages that present themselves as calendar and streak utilities but include a bundled native binary that is the same implant across the set. The packages are:
- streak-metrics-math@1.0.0, 1.0.1
- kit-map-vim@1.0.0
- streak-map-cache@1.0.0
- streak-map-kit@1.0.0
- map-streak-kit@1.0.0
- streak-cache-map@1.0.0
- streak-calc-metrics@1.0.0
- streak-calc-math@1.0.0
- streak-math-abz@1.0.0
- streak-metricsaz@1.0.0
- streak-math-metrics@1.0.0
- streak-metricazbd@1.0.0
- streak-metricsazb@1.0.0
- streak-kit-map@1.0.0
Each package contains a native file with names such as math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin. The binary appears either directly in the package's dist/ directory or under dist/internal/, but TrendAI reported the contents are the same: the RedShell Linux beacon that is part of RedC2 4.0.
How the loader activates the RedShell beacon
According to researcher Aliakbar Zahravi, delivery is embedded in the module's entry file. "Delivery is handled by the package entry file, dist/index.mjs, which acts as a trojan loader," Zahravi said. He added that the module "re-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function required."
TrendAI emphasized that a single import anywhere in a dependency graph — even a transitive import — is sufficient to mark the bundled binary executable and start it as a detached background process, triggering the Linux beacon without further action by the developer or user.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRedC2 4.0: capabilities, AI assistant, and version history
RedC2 4.0 is marketed as a cross-platform command-and-control framework with an extensive feature set. The framework's advertised capabilities include surveillance, credential theft, payload loading, mass-operation features, terminal access, file transfer, staged payload delivery, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files (BOFs), .NET assemblies, and shellcode.
TrendAI noted that the Linux variant—through the RedShell beacon introduced in version 4.0—provides an interactive shell via /bin/sh and exposes Linux-specific commands for system discovery, file operations, data collection (including SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting. The Windows and macOS beacons offer similar functionality; TrendAI reported that the Windows beacon additionally includes User Account Control (UAC) bypass techniques, antivirus and endpoint-detection tampering, and lateral-movement capabilities that the macOS version lacks.
RedC2's development timeline in the reporting shows version 2.0 released in August 2025, version 3.0 sold earlier this January, and version 4.0 appearing with the RedShell Linux beacon functionality.
Red Agent, RedC2 EXT, and the commercial footprint
RedC2 extends its control layer with a command-line extension called RedC2 EXT and an LLM-driven component named Red Agent. TrendAI reported that Red Agent is "an LLM-backed command execution layer that turns natural-language intent into framework beacon commands," allowing operators to convert natural-language prompts into actionable command sequences.
The framework was advertised by a threat actor named "MarlboroMan" on Hack Forums in early June 2026. A clearnet website branded Red Offsec markets the product and claims: "Red C2 is a multi-language, multi-OS command and control framework designed for Windows, Linux, and macOS. The entire framework was built with evasion as a core principle, utilizing the latest developments and techniques in the offensive security field." The product listing is priced at $99.99, and Red Offsec's Terms of Service say the tool is intended for red-team professionals and forbid unauthorized use.
Connections to recent supply-chain compromises and observed overlaps
TrendAI placed the npm campaign in the context of a recent coordinated supply-chain compromise that affected three Rust crates—arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9—which were poisoned with a malicious proc-macro1 dependency that executed cross-platform malware during Cargo builds. That malware profiled infected devices, cataloged Chromium-based browsers, established persistence, and beacons to attacker-controlled infrastructure for tasking and payload downloads.
Investigators suspect a maintainer's publishing credentials were compromised to push the poisoned Rust packages. TrendAI reported that evidence points to infrastructure overlaps with prior software supply-chain attacks targeting Mastra and Axios, both of which have been linked to North Korean threat actors in the reporting.
What this means for technologists, affected enterprises, and open-source maintainers
- Technologists and security teams: watch for npm packages that bundle native binaries in dist/ and for modules whose entry files execute binaries on import; network detections for RedShell-style beaconing to Windows or Linux C2 infrastructure may be key to discovery.
- Affected enterprises and procurement leaders: a commercially marketed C2 tool sold for $99.99 and advertised with an AI assistant means off-the-shelf frameworks can appear in supply chains; vetting dependencies and supply-chain integrity checks are highlighted by this campaign.
- Open-source maintainers: the Rust crate incident demonstrates that compromised publishing credentials can push malicious updates; maintainers may be compelled to review account security and package provenance procedures after these incidents.
The campaign reported by TrendAI shows how functional utility packages can be weaponized to drop advanced, AI-integrated implants. The combination of stealthy automatic execution on import, a cross-platform commercial C2 ecosystem, and an LLM-driven operator layer tightens the bridge between commoditized offensive tools and supply-chain distribution mechanisms.
