Malicious npm packages deliver RedC2 Linux backdoor

Cybersecurity researchers from TrendAI have identified a software supply chain attack involving 14 trojanized npm packages. These malicious packages masquerade as legitimate, functional calendar and streak-calculation utilities to avoid detection.

When an affected module is imported, the package automatically executes a bundled Linux backdoor known as RedShell, which is associated with the RedC2 4.0 command-and-control framework. The malware is disguised as a native math accelerator or helper file with names such as ‘math-core.bin’ or ‘calc.bin’.

The attack is particularly stealthy because it does not rely on npm lifecycle hooks or install scripts; instead, the payload is triggered simply by importing the module. This allows the implant to bypass security controls like ‘--ignore-scripts’. Once active, the RedC2 implant can collect credentials, explore networks, and facilitate post-exploitation activities by communicating with remote servers.