The RedC2 malware campaign shows how an ordinary npm import can become an execution path for a Linux backdoor. TrendAI identified 14 working calendar and streak utility packages that concealed the RedShell Linux implant for RedC2 4.0.
Unlike many malicious packages, this npm supply chain attack does not depend on a preinstall or postinstall script. The package entry file launches the implant when the module loads, including when another dependency imports it transitively.
This behavior makes developer workstations an important control point. The malicious code runs where developers may access source repositories, SSH keys, browser-stored credentials, internal services, and other sensitive resources.
TrendAI found the malicious packages posing as dependency-free utilities for calendar and streak calculations. Their advertised functions worked, reducing the chance that a developer would immediately identify the packages as suspicious.
Each package also contained the same Linux ELF binary under names such as math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin. The files appeared either in dist/ or dist/internal/ and were presented as native math accelerators.
The package entry file, dist/index.mjs, re-exported legitimate date helpers while running an asynchronous initialization routine. That routine:
Located the bundled binary.
Set the binary’s permissions to 0755 in the analyzed variant.
Compared its SHA-256 hash with a hardcoded value.
Launched it as a detached child process without invoking a shell.
Because the loader executes during module evaluation, npm install –ignore-scripts does not stop it. A direct or transitive import is enough to trigger the payload.
RedShell turns package execution into endpoint access
The deployed payload is the RedShell Linux backdoor introduced with RedC2 4.0. After execution, it uses a double-fork technique to detach from the terminal and run in the background.
RedShell can provide operators with:
Interactive command execution through /bin/sh.
System, process, user, interface, and network discovery.
File upload, download, compression, and bulk extraction.
Collection of SSH keys and browser credential files.
In-memory ELF execution through memfd_create.
Shellcode execution through executable memory mappings.
Persistence through cron, .bashrc, user-level systemd, or XDG autostart.
SOCKS5 proxying, TCP forwarding, and network pivoting.
The analyzed implant attempted to connect to 217.60.77.63 over TCP port 8792. It protected its main command channel with custom obfuscation over TLS, although it disabled certificate verification. Some bulk data extraction and payload-transfer functions used separate plaintext HTTP connections.
What is Threat Classification?
Learn how threat classification helps IT teams prioritize and manage endpoint alerts.
Red Agent changes the operator workflow
RedC2 4.0 includes an AI-assisted C2 component called Red Agent. This LLM-backed layer accepts natural-language instructions and converts them into ordered framework commands.
Red Agent does not make the initial package execution autonomous. Instead, it simplifies post-exploitation operations by reducing the operator’s need to remember individual beacon commands. An operator could describe a goal such as locating files or collecting credentials, and the framework would translate that request into supported actions.
The AI layer increases operational accessibility, but the underlying risk still comes from RedShell’s established command, collection, persistence, and pivoting capabilities.
Signals that require immediate investigation
Investigation point
Evidence to check
Priority action
Dependency exposure
Any of the 14 identified package names in manifests, lockfiles,
caches, or node_modules
Remove the package and identify every system where it loaded
Bundled implant
Suspicious .bin or .dat files under package dist/ directories; SHA-256 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466
Preserve evidence and investigate the host as potentially compromised
Execution
Permission changes or detached native processes launched by Node.js
from node_modules
Isolate the endpoint using Linux-capable security or network controls
Remove persistence only after collecting relevant evidence
Network activity
Connections to 217.60.77.63 on ports 8792, 8060, or 8888
Block known infrastructure and review surrounding network activity
Credential exposure
Access to SSH material or browser credential stores
Rotate exposed credentials and revoke sessions from a clean system
Finding a package in a dependency tree establishes exposure, not necessarily successful execution. Teams should determine whether an application imported the module and correlate that evidence with process, file, persistence, and network activity.
Developer endpoints need supply-chain controls
Effective developer endpoint security starts before a package reaches production. Development teams should review direct and transitive dependencies, restrict unapproved packages, pin approved versions, and investigate new dependencies that unexpectedly bundle native executables.
Organizations should also:
Scan package contents rather than relying only on lifecycle-script checks.
Review lockfiles and dependency trees across local development and build environments.
Restrict long-lived secrets on developer systems.
Separate development privileges from production access.
Monitor native processes launched from package directories.
Rotate SSH keys and other exposed secrets after confirmed execution.
Removing the malicious dependency alone does not eliminate persistence, invalidate stolen credentials, or remove payloads already executing on affected systems.
Featured resource
Cybersecurity kit
Get essential cybersecurity resources: blueprints, frameworks, checklists, templates, and guides to protect your enterprise effectively.
RedC2 is a cross-platform command-and-control framework. The analyzed npm packages delivered their RedShell Linux implant, which supports post-exploitation and credential collection.
Does npm install –ignore-scripts stop these packages?
No. The loader runs when the package module is imported, not through npm lifecycle scripts such as preinstall or postinstall.
Was the npm platform itself compromised?
The reviewed research does not report a compromise of npm infrastructure. It describes malicious packages published within the npm ecosystem.
Conclusion
The RedC2 malware campaign exposes a gap in defenses that inspect npm installation hooks but overlook code executed during ordinary module imports. Functional packages can still carry native payloads deep into the software supply chain.
Organizations should treat confirmed package execution as a potential endpoint compromise, investigate persistence and network activity, and rotate credentials that RedShell could have accessed.
Strengthen defenses across developer endpoints
Standardize security controls across managed endpoints. Start your free trial.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
