RedC2 Linux Implant npm
Security researchers just found a new supply chain attack targeting npm developers. Trojanized packages are masquerading as harmless calendar and streak utilities. But behind the scenes, they're dropping an AI-powered Linux backdoor called RedC2 4.0.
The packages are functional. They actually work. That's what makes them dangerous.
Trend Micro's TrendAI published the report. Let me break down what's happening and how to protect yourself.
Quick Summary
- 14 malicious npm packages identified
- Deliver RedC2 4.0 Linux implant
- No install hook needed – a single import triggers execution
- Packages are functional to avoid suspicion
- RedC2 is an AI-powered C2 framework
- Sold on cybercrime forums for $99.99
The Malicious Packages
Here are the packages you need to watch out for:
- [email protected],1.0.1
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
All these packages are functional. They actually work as calendar and streak utilities. That's what makes them dangerous, they look legitimate.
Attack Mechanism Overview
The Point of Entry:
The entry file for the package serves as the trojan loader. The date helpers are re-exported and the implant embedded within the package is automatically executed upon loading.
The Execution:
Upon loading the module, the embedded binary is located and marked as executable before executing it as a daemonized process without an install hook. A single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.
The Bundled Binary:
The binary is framed as a native math accelerator. The file name varies across packages. But what it contains is the same: the RedShell Linux beacon for RedC2 4.0.
What Is RedC2 4.0?
RedC2 4.0 is marketed on cybercrime forums as a cross-platform toolkit for Windows, macOS, and Linux. It provides surveillance, identity theft, payload delivery, and mass deployment capabilities.
The Timeline:
- Version 2.0: August 2025
- Version 3.0: January 2026
- Version 4.0: June 2026
The Threat Actor:
The version was advertised by a threat actor named "MarlboroMan" on Hack Forums. He described it as a C2 framework "built for evasion."
The Price:
RedC2 is available for purchase for $99.99 on a clearnet website branded Red Offsec.
RedC2 Features
The C2 Framework:
- Terminal access
- File transfer
- Staged payload delivery
- Data collection
- Multi-beacon operation
- Network visualization
- Host-to-host tunneling
- In-memory execution
The RedShell Linux Beacon:
Once deployed, it provides an interactive shell through /bin/sh. It exposes Linux-specific commands for system discovery, file operations, data collection, execution, persistence, and network pivoting.
The AI Component:
RedC2 includes an AI assistant called Red Agent. It turns natural-language prompts into framework commands.
What It Means:
"By interacting with a model tuned for red-team operations, an operator inputs natural-language prompts, and the framework translates them into actionable command sequences," TrendAI said. "This abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently."
The Legal Facade
Red Offsec's Terms of Service prohibit customers from using the tool for unauthorized computer access or hacking without permission. But as we've seen, that doesn't stop attackers from using it.
The Rust Crates Connection
This campaign comes close on the heels of a similar supply chain attack affecting three Rust crates. They were compromised with malicious code that executed cross-platform malware during Cargo builds.
It's suspected that maintainer credentials were compromised. There is evidence that suggests overlap in infrastructure used in attacks from North Korean threat actors.
Developer Actions to Take
Dependency Check:
Inspect your package.json file and lock files to see whether you have any of the above packages.
Remove Dangerous Packages:
If any of the above packages exist on your system, remove them immediately.
Conduct an Audit:
Detect whether there is anything wrong with your systems.
Be Cautious:
Functional code doesn’t guarantee good intentions. Be careful when installing npm packages.
The Bottom Line
Trojanized npm packages are delivering the RedC2 4.0 Linux implant. The packages masquerade as functional calendar utilities but hide AI-powered backdoor malware.
What You Need to Know:
- 14 malicious npm packages identified
- Deliver RedShell Linux beacon
- No install hook needed – single import triggers execution
- RedC2 4.0 is an AI-powered C2 framework
- Sold for $99.99 on cybercrime forums
What You Need to Do:
- Check your dependencies
- Remove suspicious packages
- Audit your systems
- Be careful what you install
FAQ Section
What is the RedC2 Linux implant npm campaign?
It's a supply chain attack where trojanized npm packages deliver the RedC2 4.0 Linux implant. The packages masquerade as functional calendar utilities.
How does the attack work?
When the module loads, it locates a bundled binary, marks it executable, and launches it as a detached background process. Just one imported file can be enough to load the payload.
RedC2 4.0 – What is it?
AI-based C2 framework that can be used to conduct various operations such as monitoring, credential harvesting, payload delivery, and more.
What should the developers do?
Ensure these packages are present in their respective package.json files and lock files too. Remove them if found. Audit your systems for signs of compromise.
Who is behind this?
The RedC2 framework is sold by a threat actor named "MarlboroMan" on Hack Forums. The npm campaign hasn't been attributed to a specific actor.
