Trojanized npm packages ship RedC2 4.0, a Linux backdoor with an AI-assisted C2

On August 20, 2026, Trend Micro disclosed fourteen functional npm packages that drop RedShell, the Linux beacon of the RedC2 4.0 C2 framework, with no install hook and no exported function call. Audit your transitive dependencies and recent package additions before a single import compromises your servers.