Trend Micro researchers have identified 14 npm packages that function exactly as advertised — as calendar helpers and habit-streak utilities — while quietly dropping a fully featured, AI-assisted Linux backdoor called RedC2 4.0 onto any machine that imports them. The campaign is notable less for its scale than for what it delivers: a commercial red-team framework, sold on cybercrime forums by an actor tracked as MarlboroMan under the brand Red Offsec, repurposed as off-the-shelf npm malware.
What Happened
The packages — names include streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, and streak-math-metrics, among others — genuinely implement the date/streak-tracking functionality they claim to. That functional cover is the point: none of them trip the usual “package does nothing but exfiltrate” heuristic.
The malicious logic lives in the package entry file, dist/index.mjs, which re-exports the legitimate date helpers and, as a side effect, locates a bundled binary — named variously math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin depending on the package — marks it executable, and launches it as a detached background process. Critically, researcher Aliakbar Zahravi noted no postinstall/preinstall hook and no exported function call are required: a single import anywhere in a project’s dependency graph, even several levels deep in a transitive dependency, is enough to execute the payload.
Technical Details
The dropped binary is a Linux implant built on RedC2 4.0, a cross-platform (Windows, macOS, Linux) C2 framework actively marketed on underground forums. On Linux, the beacon — internally called RedShell — spawns an interactive shell via /bin/sh and exposes commands for system discovery, file operations, credential and browser-data collection (including SSH private keys), arbitrary code execution, persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting — a full post-exploitation toolkit in a single beacon.
RedC2 4.0’s headline addition is Red Agent, an LLM-backed control layer bolted onto the C2. Instead of an operator hand-crafting beacon commands, they type a natural-language instruction — e.g., “enumerate this host and dump SSH keys” — and Red Agent’s model translates it into the correct sequence of framework commands. It lowers the skill floor for running the implant’s full capability set and speeds up manual post-exploitation work that previously required familiarity with the framework’s command syntax.
There is no CVE here: this is a malicious-package campaign, not a flaw in npm or Node.js itself. Red Offsec’s published terms of service nominally prohibit unauthorized access and hacking without permission — boilerplate that provides the vendor legal cover while doing nothing to stop the tool from being weaponized exactly this way.
Impact
Any project, CI pipeline, or developer machine that installed and imported one of the affected packages should be treated as compromised, not merely at risk — execution requires nothing beyond a normal npm install plus a single import touching the package, which most projects will do simply by using the functionality it advertises. Because the beacon supports credential harvesting, SSH key theft, and network pivoting, exposure extends beyond the initial host to anything reachable from it, including CI runners with cloud or registry credentials and internal networks accessible via the SOCKS5 proxy feature.
What To Do Now
Search package-lock.json / npm-shrinkwrap.json / pnpm-lock.yaml and node_modules trees for the named packages and for any of the listed binary filenames on disk. Treat any host where a match is found as compromised: rotate SSH keys, cloud and CI credentials, and any secrets accessible from that host or its network segment; rebuild affected machines and CI runners from known-good images rather than attempting in-place cleanup. Hunt for detached background processes spawned from node_modules paths and for outbound SOCKS5/proxy traffic originating from build or developer hosts. Longer term, this campaign is another argument for import-time allowlisting or sandboxing of npm dependencies and for auditing transitive dependencies, not just direct ones, since a single nested import is sufficient to trigger the payload.