Fourteen trojanized npm packages drop RedC2 4.0 backdoor on import, no install hook required

Trend Micro's TrendAI team has documented a cluster of fourteen trojanized npm packages that masquerade as working calendar and streak utilities while delivering the RedC2 4.0 Linux backdoor on module load. The packages provide the promised functionality, which is what makes them harder to dismiss at a glance, but beneath the date helpers is code that drops a Linux implant as soon as any file in the dependency graph imports the module.

All fourteen packages return risk_state: critical with supply_chain.compromised: true in Attestd. All have empty cve_ids. The supply chain signal is the only check that catches these.

Full analysis: Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 — TrendAI, August 21, 2026.

The import-time execution pattern#

The payload loader lives in dist/index.mjs, the package entry file. It re-exports the date helpers the package advertises, then immediately launches the bundled implant as a detached background process. No preinstall or postinstall hook. No exported function that needs to be called.

A single import or require() anywhere in the dependency graph, including from a transitive dependency, is enough to execute the payload. The process runs detached and persists after the importing process exits.

This is now the third distinct campaign in 2026 using import-time rather than install-time execution, following JoyFill in July and the WEL1DROPPER cluster in August. The technique directly defeats --ignore-scripts, the conventional first-line advice for suspicious packages. Import-time execution bypasses install-step sandboxing entirely because the code runs when the application loads, not when npm installs it.

What Attestd returns#

curl "https://api.attestd.io/v1/check?product=streak-metrics-math&version=1.0.0" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "streak-metrics-math",
  "version": "1.0.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "actively_exploited": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in streak-metrics-math (npm)",
    "compromised_at": "2026-07-30T20:13:35Z",
    "removed_at": null,
    "source_published_at": "2026-07-30T20:13:35Z",
    "observed_at": "2026-08-04T21:48:23Z",
    "ingested_at": "2026-08-04T21:48:23Z"
  },
  "supply_chain_monitored": true
}

No CVEs. risk_state: critical from the supply chain signal alone. The same shape holds across the full cluster.

The full package list#

All fifteen version checks return supply_chain.compromised: true with empty cve_ids.

The cluster spans from July 30 to August 12. streak-metrics-math is the earliest published and is the only package with two compromised versions. kit-map-vim is the most recently published.

The payload: RedC2 4.0#

RedC2 4.0 is a commercial cross-platform command-and-control framework sold on cybercrime forums by a threat actor named MarlboroMan for $99.99. The framework was advertised on Hack Forums in June 2026 as built for evasion. Version 4.0 introduced the RedShell Linux beacon dropped by this cluster.

The Linux beacon provides an interactive shell via /bin/sh and exposes commands for system discovery, file operations, credential harvesting (SSH keys and browser credentials), persistence, in-memory ELF execution, SOCKS5 proxying, and network pivoting. Once deployed it registers with a C2 server and enters a command-processing loop.

The framework also ships a component called Red Agent, an LLM-backed command execution layer that translates natural language instructions from the operator into framework beacon commands. An operator inputs a natural language prompt describing the desired action, and Red Agent generates the corresponding command sequence. The abstraction reduces the technical skill required to run complex post-exploitation tasks.

The use of an LLM-backed C2 component to lower the barrier for post-exploitation is a notable development. It means autonomous attack capability is being commoditized at the C2 layer, not just at the delivery layer.

The functional package technique#

Most trojanized npm packages are obviously fake on inspection: no README, no real code, a name that looks generated. The RedC2 cluster packages are different. They provide working calendar and streak calculation utilities alongside the malicious payload.

A developer or a code review system doing a quick check on streak-metrics-math would find that it does what it says. The date helpers work. The package passes functional tests. The malicious binary is buried in the dist directory and named to look like a native math accelerator (math-core.bin, calc-math.bin, and similar).

This technique trades ease of publication for persistence. A package that provides real value is less likely to be flagged by casual inspection and more likely to stay in a lockfile once added.

Related: Rust crates compromise#

TrendAI's report notes a connected compromise affecting three Rust crates: [email protected], [email protected], and [email protected]. These were compromised via a malicious proc-macro dependency that executed cross-platform malware during Cargo builds. Infrastructure overlaps with prior supply chain attacks targeting Mastra and Axios suggest North Korean threat actor involvement.

Attestd's Rust ecosystem supply chain coverage is not yet live. The Rust crates are noted here as context from TrendAI's analysis. Rust ecosystem coverage is planned for Q4 2026.

What to do#

Remove all fourteen packages from any dependency tree or lockfile. None have a clean patched version. The only safe path is removing the dependency entirely.

If any of these packages were imported by a running Node.js process, treat the environment as compromised. The detached process spawned at import time may have persisted after the host process exited. Check for unexpected background processes, rotate credentials accessible from the affected environment, and audit SSH keys and browser credential stores on affected developer machines.

Coverage#

All fourteen packages are covered and return risk_state: critical with supply_chain.compromised: true. Responses are live from the production API as of August 23, 2026.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. For the broader pattern of import-time execution in 2026 campaigns, see attestd.io/blog/npm-supply-chain-attacks-how-they-work.