Trojan npm Packages Drop AI-Powered Linux Backdoor

Security researchers have uncovered a cluster of malicious npm packages that pose as functional calendar and streak utilities while secretly dropping a Linux backdoor powered by artificial intelligence. The packages, identified by Trend Micro's TrendAI unit, deliver an implant dubbed RedC2 4.0, a command-and-control framework that has been under active development for over a year.

Stealthy Loader Mechanism

The trojanized packages are designed to execute the payload without requiring an install hook. According to TrendAI, when the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process. A single import anywhere in the dependency graph, even a transitive one, is enough to trigger the payload.

The packages come with working functionality, but beneath that garb of date utilities is code that drops the Linux backdoor by disguising it as a native math accelerator. The file names vary across packages, including math-core.bin, math-calc.bin, calc-math.dat, and others, located in the dist/ directory or its subdirectory.

The RedC2 4.0 Framework

RedC2 4.0 is marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux. It offers surveillance, credential theft, payload loading, and mass-operation capabilities. The version was advertised by a threat actor named "MarlboroMan" on Hack Forums in early June 2026, describing it as a command-and-control framework "built for evasion."

The framework has been in active development for at least a year, with version 3.0 sold earlier this January and version 2.0 released in August 2025. The RedShell Linux beacon was introduced in version 4.0.

RedShell Linux Beacon Capabilities

The Linux variant of the beacon provides an interactive shell through /bin/sh and exposes Linux-specific commands for system discovery, file operations, data collection (including SSH keys and browser credentials), execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting.

It establishes communication with a C2 server and registers the infected system by gathering basic system information and transmitting it as a "check-in message." It then enters a command-processing loop to process incoming instructions, execute them via /bin/sh, and send results back.

The Windows and macOS counterparts cover similar ground, allowing file operations, host and network reconnaissance, user enumeration, and data harvesting. The Windows beacon also incorporates UAC bypass, antivirus and endpoint detection, antivirus tampering, in-memory execution, and lateral movement that the macOS version lacks.

AI-Powered Red Agent

RedC2 extends its control layer with a command-line extension called RedC2 EXT and an LLM-driven component called Red Agent. This AI assistant allows operators to orchestrate complex post-exploitation tasks, such as network reconnaissance and credential dumping, using natural language commands.

"RedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into framework beacon commands"

— Aliakbar Zahravi, security researcher at Trend Micro

Red Offsec, the vendor behind RedC2, has characterized Red Agent as an "AI-powered command execution system specialized for penetration testing." By interacting with a model tuned for red-team operations, an operator inputs natural-language prompts, and the framework translates them into actionable command sequences.

Distribution and Pricing

On a clearnet website branded Red Offsec, the threat actor claims that RedC2 is a multi-language, multi-OS command and control framework designed for Windows, Linux, and macOS, built with evasion as a core principle. The tool is available for purchase for $99.99.

Red Offsec's Terms of Service expressly prohibit customers from using the tool for "unauthorized computer access," "hacking without explicit permission," and "abuse, exploitation, or damage of systems you do not own or are not authorized to test."

Supply Chain Context

The discovery comes on the heels of a coordinated supply chain attack affecting three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9), which were compromised with a malicious proc-macro1 dependency that executed cross-platform malware automatically during Cargo builds.

That malware was designed to profile infected devices, catalog Chromium-based browsers, establish persistence, and beacon to attacker-controlled infrastructure. Evidence points to infrastructure overlaps with prior software supply chain attacks targeting Mastra and Axios, both linked to North Korean threat actors.

Key Statistics

• 14 trojanized npm packages identified
• RedC2 4.0 available for $99.99
• Version 3.0 sold in January 2026, version 2.0 released in August 2025

Implications for Developers

The use of functional packages in this attack highlights a growing challenge for software supply chain security. Developers often rely on package managers to vet dependencies, but these packages pass basic checks because they work as advertised. The addition of AI-driven frameworks like RedC2 lowers the barrier to entry for less experienced attackers, allowing them to execute complex intrusions with minimal effort.

As TrendAI noted, this abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently. For organizations, this means the threat landscape is broadening, and vigilance in reviewing dependencies is more critical than ever.