Published on gastropod.io on 08-26-2026

Fourteen npm Packages Shipped Real Utility Code, and a Linux Backdoor Underneath

Tags: vulnerability-intelligence, software-supply-chain-security, npm, credential-theft, ci-cd-security, malware

TrendAI researchers published findings on fourteen npm packages that work exactly as their names promise. streak-metrics-math, kit-map-vim, streak-map-cache, and eleven similarly named date and calculation utilities all export functioning helper code. Oh I almost forgot... each one also includes a Linux backdoor on load. Feature-rich for sure.

The loader is a single dist/index.mjs file, an async function that runs on import with no separate install hook. That detail matters because a lot of dependency scanning still treats --ignore-scripts as sufficient protection against a malicious package. Obviously it isn't enough for this. According to TrendAI's writeup, one import anywhere in a project's dependency graph, including a transitive one nobody added directly, is enough to trigger it. The loader resolves a bundled ELF binary stored under names like math-core.bin or calc-cache.bin, checks its SHA-256 hash against a hardcoded value, marks it executable, and spawns it as a detached process.

What runs next is RedShell, the Linux implant behind the RedC2 4.0 framework. It opens an interactive shell, pulls SSH keys and browser credentials, discovers local databases, and sets up SOCKS5 proxying so a compromised build server or developer machine becomes a path into whatever internal network it can reach. Persistence goes in through cron @reboot entries, .bashrc edits, user-level systemd services, and XDG autostart entries, whichever survives the environment it runs in. Command and control runs across three separate ports on the same IP, one wrapped in TLS with a custom XOR cipher, two others in plain HTTP, plus a fallback exfiltration path through the public file host litterbox.catbox.moe (The Hacker News).

The framework's name for its AI feature, Red Agent, invites more than it delivers. It doesn't make the malware adapt to defenses on its own. It's an LLM-backed interface layer that lets whoever is running the compromised network type a plain-language goal, something like "dump credentials," and have that translated into an ordered chain of beacon commands. TrendAI's analysis is direct about this: the implant itself still runs on static encryption and hardcoded command logic. The AI piece lowers the skill needed to operate RedC2 profitably once access exists, not the skill needed to gain that access in the first place.

TrendAI traces the framework to a seller using the handle MarlboroMan, active on Hack Forums since around June, and notes infrastructure overlap with earlier campaigns tied to the Mastra and Axios npm compromises, both previously linked to suspected North Korean operators. Defenders out there, you need to check whether any of the fourteen package names, or the SHA-256 hash TrendAI published for the bundled binary, shows up anywhere in a lockfile, build cache, or CI log.

The naming choices here aren't random. Small, single-purpose utility packages for date math or key-value caching are exactly the kind of dependency that gets added without a second look and rarely gets re-reviewed once it's in a lockfile. Combined with a trigger that fires on any import, direct or transitive, this is built to survive a security review that only checks the packages listed in package.json.

shameless gastropod.io plug...

Gastropod tracks every artifact in a dependency tree at the version level, not just the top layer, and correlates known-malicious hashes and publisher signals against that full graph, so a match on one of these packages surfaces every project pulling it in regardless of how many layers deep the dependency is declared. The product page covers how that dependency-graph correlation works.

Sources:

• 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 (The Hacker News)
• Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant (TrendAI)
• RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting (gbhackers)
• RedC2 AI-Powered Linux Malware Delivered Through Malicious npm Packages (Cyber Press)