Published
- 4 min read
By Allan D - Editor, AI Security Wire
Trojanized npm Packages Deliver AI-Powered C2 Framework RedC2 4.0
Fourteen npm packages that looked like ordinary calendar-streak trackers and math utilities turned out to be carrying something considerably nastier. Trend Micro’s research division, TrendAI, published findings on August 21 showing that these packages, while fully functional on the surface, quietly dropped a Linux backdoor the instant they were imported. No install hook. No suspicious postinstall script to catch in a review. Just a single import statement anywhere in a project’s dependency chain, even several layers deep, and the payload fires.
How the Attack Actually Works
The packages carry names built to blend into a crowded ecosystem: streak-metrics-math, kit-map-vim, streak-map-cache, map-streak-kit, and nine similar variants riffing on “streak,” “calc,” and “map.” Each one does what it says on the tin, which is exactly why it’s hard to catch. Bundled alongside the legitimate code sits a binary, going by names like math-core.bin or calc-math.dat, that self-executes on load.
According to researcher Aliakbar Zahravi, delivery runs through the package’s entry file, dist/index.mjs, which functions as a trojan loader. “No install hook function call is needed,” the TrendAI writeup notes. “A single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.” That’s the detail that should worry dependency-heavy teams the most: you don’t have to install the package directly. Something three or four layers into your node_modules tree can be enough.
Once triggered, the payload deploys something TrendAI calls a “RedShell” beacon, which phones home to infrastructure running RedC2 4.0.
The AI Angle: Red Agent
RedC2 4.0 itself isn’t new territory for cybercrime, plenty of commercial C2 kits circulate on forums like this one. It’s a cross-platform framework covering Windows, macOS, and Linux, sold for $99.99 by a seller going by “MarlboroMan” who’s been advertising it on Hack Forums since June. The feature list reads like most modern C2 toolkits: terminal control, credential theft, UAC bypass, in-memory execution of shellcode and .NET assemblies, SOCKS5 pivoting.
What sets this version apart is a component called Red Agent. It’s an LLM-driven command layer sitting on top of the framework, and it lets an operator type instructions in plain English rather than memorizing the tool’s native command syntax. Zahravi described it directly: “By interacting with a model tuned for red-team operations, an operator inputs natural-language prompts, and the framework translates them into actionable command sequences.” Terminal control, credential harvesting, lateral movement steps, all of it becomes accessible to someone who can describe what they want rather than someone who knows the underlying commands.
That’s the pattern showing up across a growing slice of criminal tooling this year: lowering the technical bar for post-exploitation work by wrapping it in a natural-language interface. It doesn’t introduce a new capability so much as it removes a skill requirement that used to gate who could run a multi-stage intrusion effectively.
Why This Matters for Supply Chain Security
No CVE got assigned here, this is a malware and supply-chain disclosure rather than a vulnerability in a specific product, but the mechanics are what make it worth flagging. Functional-looking packages with hidden payloads that fire on transitive import are genuinely difficult to catch through typical dependency review, which tends to focus on direct dependencies and known bad package names rather than deep-tree auditing.
Teams running Node.js projects with any of the 14 named packages in their tree, direct or transitive, should treat affected systems as potentially compromised: rotate credentials, check for the named binary files on disk, and review outbound connections for unfamiliar beacon traffic. More broadly, this is a case for running regular full-tree dependency audits rather than one-time reviews at install time, since a package that behaved fine last month can still be hiding something that only executes once the right import path gets triggered.
References
Frequently Asked Questions
- What did researchers find in the malicious npm packages?
- TrendAI, Trend Micro's research arm, identified 14 npm packages disguised as calendar and math utility libraries. Each one worked exactly as advertised, but bundled a hidden Linux binary that ran automatically the moment the package was imported anywhere in a project's dependency tree, no install script required.
- What is RedC2 4.0 and what makes it different from a typical C2 tool?
- RedC2 4.0 is a commercial command-and-control framework sold for $99.99 on a cybercrime forum since June 2026. Beyond standard C2 features like credential theft and SOCKS5 proxying, it includes 'Red Agent,' an LLM-driven layer that converts plain-English instructions into working post-exploitation command sequences.
- Should developers be worried about their existing dependencies?
- Anyone who pulled in one of the 14 named packages, even as a transitive dependency, should assume compromise and rotate credentials on affected systems. More broadly, this incident is a reminder to audit dependency trees regularly rather than trusting that a package doing what it claims means it's safe.