RedC2 4.0: Trojanized npm Packages Ship an AI-Steered Linux Backdoor

What was found

Researchers at TrendAI, Trend Micro's enterprise security business, identified 14 npm packages — with names like streak-metrics-math, streak-map-kit, and kit-map-vim — presenting themselves as calendar and habit-streak helper libraries. The packages are not empty decoys: they deliver the date-utility functionality they advertise, which is precisely what makes them harder to flag on inspection alone.

Underneath that working front end, the code locates a bundled binary framed as a "native math accelerator," marks it executable, and launches it as a detached background process. No postinstall hook or explicit function call is needed — a single import, even a transitive one buried several dependencies deep, is enough to trigger execution. That payload is RedC2 4.0, a Linux-targeting implant tied to a commercial command-and-control framework that also supports Windows and macOS.

A commercial C2 kit with an AI front end

RedC2 is sold on underground hacking forums by an actor using the handle "MarlboroMan," with a release history researchers trace from version 2.0 (August 2025) through 3.0 (January 2026) to 4.0, advertised in June 2026 — a fast iteration cadence typical of malware-as-a-service tooling. The framework itself is described as feature-rich, covering:

• Terminal access and file transfer
• Staged payload delivery and in-memory execution of multiple code formats
• Multi-beacon operation and network visualization
• Host-to-host tunneling and lateral movement
• Credential theft, surveillance, UAC bypass (Windows), and antivirus tampering

The distinguishing feature of 4.0 is Red Agent, an LLM-backed command execution layer. An operator types a natural-language request, and a model tuned for red-team operations translates it into actionable beacon command sequences — collapsing what used to require familiarity with the framework's command syntax into a conversational interface.

Why the AI layer matters

This is not a novel intrusion technique — trojanized npm packages and commercial C2 kits both have a long history. What's notable is the framework vendor building an LLM interface directly into the operator tooling, which reduces the operational skill floor for running multi-stage intrusions rather than introducing a new technical capability. It's a preview of a broader pattern: attacker tooling absorbing the same natural-language convenience layers that have reshaped legitimate developer tooling.

What this means for teams that consume npm packages

No CVE has been assigned and no victim or download figures have been disclosed, so this is not a patch-and-move-on advisory. The exposure is structural: any dependency, however deep in the tree, can execute arbitrary code on import. Practical steps for engineering and security teams:

• Run software composition analysis (SCA) on CI, not just at code review time, since transitive dependencies update independently of your lockfile review cadence.
• Alert on npm packages that ship or fetch platform-specific binaries, particularly ones marked executable at install or import time.
• Watch for detached background processes spawned from node_modules paths in EDR/behavioral telemetry — this is a stronger signal than static package scanning alone.
• Pin dependency versions and review diffs on version bumps for small, single-purpose utility packages, which are a common typosquat and lookalike target.

The bigger picture

Commodity C2 kits adopting LLM-assisted operation is a trend worth tracking rather than a one-off. As natural-language command layers become standard in offensive tooling, the gap between "skilled operator" and "someone who can describe what they want" narrows — which argues for supply-chain controls that don't depend on attacker sophistication as a mitigating factor.