Trojanized npm Packages Distribute RedC2 4.0 Linux Backdoor

Fourteen trojanized npm packages have been identified that appear to provide legitimate calendar and streak utility functionality but act as delivery mechanisms for the RedC2 4.0 Linux backdoor. The malicious packages, discovered by researchers, execute a bundled binary named 'RedShell' upon being imported into any application dependency graph. This execution occurs without the requirement of install hook functions or specific exported method calls, significantly increasing the probability of silent infection.

RedC2 4.0 is a sophisticated C2 framework marketed on cybercrime forums by the actor 'MarlboroMan'. It is designed for cross-platform operations, including Windows, Linux, and macOS. The Linux variant provides interactive shell access, credential theft, and network pivoting capabilities. The framework is notable for its integration of 'Red Agent', an LLM-driven component that allows operators to issue post-exploitation commands in natural language, abstracting the complexity of manual command-line sequences.

Attack Chain

1. Attacker publishes trojanized npm packages (e.g., streak-metrics-math@1.0.0) containing a hidden binary payload under the 'dist/' or 'dist/internal/' directories.
2. Victim environment imports the malicious package, triggering the 'dist/index.mjs' loader file.
3. The loader script identifies the bundled binary (e.g., math-core.bin, calc.bin) and programmatically modifies file permissions to make it executable.
4. The loader launches the 'RedShell' beacon binary as a detached, background process, bypassing common installation-time analysis.
5. The RedShell beacon establishes communication with the attacker's C2 server and transmits host system information in a registration 'check-in' message.
6. The beacon enters a command-processing loop to receive instructions, which are executed via '/bin/sh' on the host.
7. Operators utilize 'Red Agent' (LLM-based) to translate natural-language intent into specific framework commands for lateral movement, data collection, or further payload delivery.
8. Exfiltrated data (SSH keys, browser credentials) is transmitted back to the C2 operator through the established channel.

Impact

Successful deployment of the RedShell beacon grants an attacker persistent interactive access to the Linux host. The framework facilitates mass credential harvesting, network visualization, and the execution of shellcode or BOFs in-memory. This poses a severe risk to development environments and CI/CD pipelines where npm packages are frequently used, potentially allowing attackers to pivot into internal infrastructure and orchestrate complex, multi-stage intrusions.

Recommendation

• Deploy detection rules targeting the execution of binaries directly from node_modules directories, as documented in the detection rules below.
• Audit project dependencies for the package names identified in this brief (e.g., streak-metrics-math, kit-map-vim, streak-map-cache, etc.) and remove them if present.
• Implement egress filtering on build servers and developer workstations to block connections to unauthorized external IP addresses or domains identified as C2 infrastructure.
• Use npm lockfiles to pin dependency versions and perform integrity checks to ensure that no unexpected sub-dependencies have been introduced to the application.
• Monitor for unexpected background processes spawned by Node.js or npm-related processes.