Malicious npm Utilities Deploy RedC2 4.0 Linux Backdoor

Security researchers have identified 14 npm package names, representing 15 published versions, that appear to provide calendar or streak-tracking functionality while concealing a Linux backdoor. The packages deploy the RedShell beacon associated with RedC2 4.0, a cross-platform command-and-control framework.

According to Trend Micro’s TrendAI researchers, the malicious code is triggered when a package is imported. Its entry point locates a bundled file, changes its permissions, and starts it as a detached background process. Because execution does not rely on an npm installation hook or an explicit function call, importing the module anywhere in a dependency tree—including as a transitive dependency—may be sufficient to launch the implant.

Packages identified

• streak-metrics-math versions 1.0.0 and 1.0.1
• kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, and streak-kit-map, each version 1.0.0

The packages reportedly remain functional, helping them appear legitimate. Their loader presents the embedded executable as a native mathematical component. Researchers found different filenames—including math-core.bin, math-calc.bin, calc-cache.bin, and calc.bin—in the dist directory or a related subdirectory.

Once active, RedShell connects to an operator-controlled Windows or Linux server, sends system information in an initial check-in, and waits for commands. Its capabilities include shell access, file manipulation, information gathering, SSH-key and browser-credential collection, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting.

AI-assisted operations

RedC2 4.0 has been promoted on cybercrime forums and includes support for staged payloads, multiple beacons, tunneling, and in-memory execution. Its Red Agent component uses a large language model to translate natural-language requests into beacon commands, potentially allowing less-skilled operators to conduct reconnaissance, credential theft, and other multi-step actions.

The discovery highlights continuing risks in open-source package ecosystems, where apparently useful dependencies can become delivery mechanisms for advanced malware. Organizations should review npm dependencies, pin and verify versions, and monitor development systems for unexpected child processes, suspicious bundled binaries, and outbound connections.