Trojanized npm packages ship RedC2 4.0, a Linux backdoor with an AI-assisted C2

August 20, 2026. Trend Micro publishes a report describing fourteen trojanized npm packages that drop a Linux implant. Early June 2026. An actor going by “MarlboroMan” puts RedC2 4.0 up for sale on a cybercrime forum for $99.99. August 21, 2026. The Hacker News relays the analysis and details the weak link most teams still do not monitor.

For a security lead, the story fits in one sentence: you are no longer attacked only through the code you write, but through a transitive dependency nobody re-read — one that executes the moment the module loads.

A Trojan that does what it promises

The trap is not an obvious stub. The fourteen packages identified by Trend Micro — streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb and streak-kit-map — present themselves as calendar and “streak” utilities. They work: the promised functionality is actually delivered.

That is precisely what makes detection hard. Beneath the surface, each package bundles a binary with an innocuous name — math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin — tucked under dist/ or dist/internal/. That binary is no math accelerator: it is RedShell, the Linux beacon of the RedC2 4.0 framework.

The trigger mechanism is the most alarming part. Aliakbar Zahravi, the Trend Micro researcher behind the analysis, spells it out: the package entry point, dist/index.mjs, acts as a loader. It re-exports the date helpers and launches the implant as soon as the module loads. No install hook, no exported function call required — a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.

# Illustrating the risk: a transitive dependency is enough to trigger everything
npm ls streak-metrics-math        # walks the full chain
npm audit                         # will not flag an unreported package

RedC2 4.0, a C2 framework turned commodity

RedC2 is not a quiet, bespoke tool. It is a cross-platform command-and-control framework — Windows, macOS, Linux — sold openly. Version 4.0 was announced in early June 2026 on Hack Forums by “MarlboroMan”, who described it as “built for evasion.” Version 3.0 was sold in January 2026, version 2.0 in August 2025: the project has been under active development for at least a year.

The sales site, Red Offsec, lists a $99.99 price and terms of service that forbid “unauthorized computer access” — a façade clause that has never slowed distribution. The advertised capabilities set the scale: terminal access, file transfer, staged payload delivery, data collection, multi-beacon operation, network visualization, host-to-host tunneling, and in-memory execution of Beacon Object Files, .NET assemblies and shellcode.

The RedShell beacon for Linux is the piece that lands on your servers. Once deployed, it opens an interactive shell through /bin/sh and exposes commands for system discovery, file operations, data collection — SSH keys, browser credentials — persistence, in-memory ELF execution, SOCKS5 proxying and network pivoting. It registers with the C2 server through a “check-in” message, then enters a loop executing the operator’s instructions.

AI lowers the barrier to entry

The real novelty of RedC2 4.0 is not the payload, it is the control layer. The framework ships two extensions: RedC2 EXT, a command-line interface, and Red Agent, an LLM-driven component.

In practice, Red Agent translates a natural-language instruction — “run network reconnaissance, then dump credentials” — into command sequences executed by the beacons. Red Offsec describes it as an “AI-powered command execution system specialized for penetration testing.” Trend Micro draws the conclusion that matters: this abstraction lets operators of widely varying skill levels chain complex, multi-stage intrusions efficiently.

It is the first time, according to Trend Micro, that an AI-integrated C2 framework of this kind has been distributed through malicious npm packages. The combination of the two — delivery via the software supply chain, control via AI — lowers both the cost of entry and the technical barrier of the attack at the same time.

A week that was already crowded

The discovery lands right after another supply chain attack, this time against three legitimate Rust crates — [email protected], [email protected] and [email protected]. The compromised versions bundled a malicious proc-macro dependency that executed cross-platform malware automatically during Cargo builds.

Investigators suspect the maintainer’s publishing credentials were compromised. Infrastructure overlaps point to earlier attacks on Mastra and Axios, both linked to North Korean threat actors. The coincidence is not accidental: package registries have become the preferred hunting ground because they bypass the classic network perimeter.

Verdict

If you run Node.js services in production, treat this as an operational reminder, not an anecdote. The payload executes on module load, with no install hook: your code review and your npm audit are not enough. Add transitive dependency checks and pin your versions with an audited lockfile, especially for anything added since August 2026.

If you cannot audit everything, focus on the most reliable signal: packages that deliver real functionality while bundling a generically named native binary (*.bin, *.dat) under dist/. Block their installation, inspect their provenance, and walk the dependency chain with npm ls before they reach a build environment.

The rule to remember: a C2 framework sold for $99.99 and driven by natural language is now one npm package away. The question is no longer “are we a target,” but “which transitive import has already crossed the door.”

References

• 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 — The Hacker News, August 21, 2026
• Trend Micro — analysis of trojanized npm packages and RedC2 4.0, report published August 20, 2026