14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI
Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.
Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.
- 14 trojanized npm packages masquerade as calendar/streak utilities
- Single transitive import triggers RedShell Linux beacon execution
- RedC2 4.0 includes LLM-backed Red Agent command layer
- Supports in-memory execution of BOFs, .NET assemblies, shellcode
- Sold as red team toolkit; abuse would violate vendor ToS
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.004 Unix ShellT1071.001 Web ProtocolsT1105 Ingress Tool Transfer
- Threat actors
- MarlboroMan
- Malware
- RedC2
- AI models
- Red Agent
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4. 0.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.