Trojanised npm packages deliver RedC2 4.0 Linux backdoor

TrendAI said 14 npm packages were trojanised and presented themselves as calendar and streak utilities. It said the packages still provided the promised functions, but also carried code meant to load a Linux implant.

The loader sat in the package entry file and ran when the module was imported, according to TrendAI and Aliakbar Zahravi. The same binary appeared under different names inside dist/ or dist/internal/, and the article identified it as the RedShell Linux beacon used by RedC2 4.0.

The article said RedC2 4.0 had been sold on Red Offsec’s site for $99.99 and promoted on Hack Forums in early June 2026 by a threat actor called MarlboroMan. It said version 3.0 had been sold in January and version 2.0 in August 2025.

The article said the framework supported terminal access, file transfer, payload delivery, data collection, multi-beacon operation, network mapping, tunnelling and in-memory execution of BOFs, .NET assemblies and shellcode. It also said RedC2 included Red Agent, an LLM-based component for turning natural-language prompts into commands, and ended by linking the npm case with a recent Rust-crate supply-chain incident that investigators thought may have involved stolen publishing credentials.