Key Takeaways
- Researchers uncovered a series of trojanized npm packages that appear to be legitimate calendar and streak utilities but secretly deploy the RedC2 4.0 Linux implant (RedShell beacon).
- A single import of any of the listed packages—whether direct or transitive—triggers execution of the malicious binary without needing an install hook.
- RedC2 4.0 is a cross‑platform command‑and‑control (C2) framework marketed for $99.99, offering surveillance, credential theft, payload loading, mass‑operation, and an AI‑powered natural‑language interface called Red Agent.
- The Linux beacon provides an interactive shell, system reconnaissance, persistence mechanisms, in‑memory ELF execution, SOCKS5 proxying, and network pivoting, while the Windows and macOS variants add UAC bypass, AV tampering, and lateral‑movement features.
- The discovery follows a recent supply‑chain attack on Rust crates, suggesting a broader trend of compromising package registries to distribute sophisticated, AI‑enhanced malware.
- Organizations should enforce strict dependency‑integrity controls (e.g., lockfiles, provenance verification, SBOMs) and monitor for unexpected background processes spawned from npm modules.
Overview of the Discovery
TrendAI, the enterprise cybersecurity arm of Trend Micro, published a report detailing how attackers have weaponized the npm registry by publishing trojanized packages that masquerade as harmless date‑utility libraries. When a developer imports any of these modules—directly or as a transitive dependency—the package’s entry point runs a hidden loader that extracts and executes a binary payload. The attack requires no special install scripts or exported functions; the mere act of loading the module is sufficient to trigger the malicious code, making the threat particularly insidious for projects that rely on automated dependency resolution.
Identified Malicious npm Packages
The researchers enumerated fifteen malicious versions, all published at the 1.0.0 release line:
- streak-metrics-math
- kit-map-vim
- streak-map-cache
- streak-map-kit
- map-streak-kit
- streak-cache-map
- streak-calc-metrics
- streak-calc-math
- streak-math-abz
- streak-metricsaz
- streak-math-metrics
- streak-metricazbd
- streak-metricsazb
- streak-kit-map
Each package claims to provide calendar‑related or streak‑tracking helpers, yet beneath the benign façade lies a bundled binary designed to drop the RedShell Linux beacon, a core component of the RedC2 4.0 framework.
Trojan Loader Mechanism
The malicious activity is initiated from the package’s entry file, dist/index.mjs. This file re‑exports the advertised date‑helper functions to maintain usability while simultaneously performing three covert steps: locating the bundled binary (named variously math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin), marking it executable, and launching it as a detached background process. Because the loader runs during module initialization, any project that merely imports the package—whether deliberately or through a dependency chain—will unwittingly execute the payload. The absence of an install hook or exported function requirement means traditional npm audit tools that focus on scripts may miss the threat.
RedC2 4.0 Framework Capabilities
RedC2 4.0 is advertised as a cross‑platform C2 toolkit targeting Windows, macOS, and Linux. Its feature set includes:
- Interactive terminal access and file‑transfer capabilities.
- Staged payload delivery and data collection (e.g., SSH keys, browser credentials).
- Multi‑beacon operation, network visualization, and host‑to‑host tunneling.
- In‑memory execution of Beacon Object Files (BOFs), .NET assemblies, and raw shellcode.
- Persistence mechanisms tailored to each operating system.
The framework’s design emphasizes evasion, leveraging modern offensive‑security techniques to blend malicious traffic with legitimate network activity and to avoid detection by endpoint protection platforms.
RedShell Linux Beacon Execution Flow
Once deployed on a Linux host, the RedShell beacon opens an interactive shell via /bin/sh and exposes a suite of Linux‑specific commands for system discovery, file manipulation, and data harvesting. It collects basic host information, transmits a “check‑in” message to the operator‑controlled C2 server, and then enters a command‑processing loop. In this loop, it receives instructions, executes them through /bin/sh, captures the output, and relays the results back to the attacker. Additional capabilities include:
- Establishing persistence via cron jobs, systemd services, or startup scripts.
- Executing in‑memory ELF binaries to avoid writing to disk.
- Acting as a SOCKS5 proxy to facilitate network pivoting.
- Collecting SSH keys, browser-stored credentials, and other sensitive artifacts.
These functions enable attackers to maintain long‑term footholds, move laterally within internal networks, and exfiltrate data with minimal forensic footprint.
Cross‑Platform Features and Windows/macOS Specifics
While the Linux beacon focuses on stealth and proxying, the Windows and macOS counterparts extend the feature set with platform‑specific privileges. The Windows beacon incorporates User Account Control (UAC) bypass techniques, antivirus and endpoint‑detection tampering, in‑memory execution modules, and lateral‑movement utilities such as Pass‑the‑Hash or SMB relay attacks. The macOS variant lacks these advanced privilege‑escalation tricks but still provides file operations, host and network reconnaissance, user enumeration, and data harvesting comparable to the Linux and Windows versions. Across all platforms, RedC2 supports staged payload delivery, allowing operators to download additional tools or ransomware after initial compromise.
Red Offsec Marketing, Pricing, and Terms of Service
The framework is sold on a clear‑net site branded “Red Offsec” for $99.99. The promotional copy describes RedC2 as a “multi‑language, multi‑OS command and control framework designed for Windows, Linux, and macOS,” emphasizing evasion as a core principle built from the latest offensive‑security developments. Red Offsec’s Terms of Service explicitly prohibit customers from using the tool for unauthorized computer access, hacking without explicit permission, or any activity that damages systems they do not own or are not authorized to test. The vendor claims the product is intended solely for red‑team professionals who operate within legal and ethical boundaries, though the existence of a public marketplace lowers the barrier for malicious actors to acquire a sophisticated C2 platform.
AI‑Driven Red Agent and RedC2 EXT
RedC2 4.0 includes two notable extensions that enhance usability for attackers. First, RedC2 EXT provides a command‑line interface that simplifies interaction with the framework’s various modules. Second, and more prominently, Red Agent is a large language model (LLM)‑backed component that translates natural‑language prompts into actionable beacon commands. For example, an operator could type “gather SSH keys from the user’s home directory and exfiltrate them,” and Red Agent would generate the necessary sequence of low‑level commands to execute the task. This abstraction enables individuals with limited technical expertise to orchestrate complex, multi‑stage intrusions, effectively democratizing advanced post‑exploitation capabilities.
Supply‑Chain Context and Related Attacks
The RedC2 discovery follows a recent supply‑chain assault on three legitimate Rust crates—[email protected], [email protected], and [email protected]—which were poisoned via a malicious proc-macro dependency that dropped cross‑platform malware during Cargo builds. Investigators suspect the npm packages’ maintainer credentials were compromised in a similar fashion, allowing threat actors to publish the trojanized versions. Infrastructure analysis points to overlaps with earlier campaigns targeting the Mastra and Axios libraries, both of which have been linked to North Korean‑affiliated actors. This pattern suggests a coordinated effort to exploit trusted package registries as distribution vectors for sophisticated, AI‑enhanced C2 frameworks.
Implications and Mitigation Recommendations
The emergence of AI‑powered C2 tools disseminated through benign‑looking npm packages marks a significant evolution in supply‑chain threats. Organizations should:
- Enforce Dependency Integrity – Use lockfiles, enable checksum verification, and adopt tools that scrutinize package provenance (e.g.,
npm audit,socket, orsnyk). - Monitor for Anomalous Processes – Deploy endpoint detection and response (EDR) solutions capable of spotting unexpected background processes spawned from
node_modulesdirectories. - Apply Principle of Least Privilege – Run build and deployment pipelines under non‑privileged accounts to limit the impact of a compromised package.
- Educate Developers – Raise awareness about the risks of transitive dependencies and encourage the use of private registries or vetted internal mirrors for critical libraries.
- Implement Network Segmentation – Isolate development environments from production networks to hinder lateral movement should a beacon be installed.
By combining rigorous software‑supply‑chain hygiene with vigilant runtime monitoring, defenders can reduce the likelihood that a seemingly harmless npm module becomes the gateway for an AI‑driven RedC2 intrusion.