The Package Worked. A Single Import Started RedC2’s Linux Backdoor.

That execution detail is what makes the campaign more consequential than another list of malicious package names. According to research published by TrendAI on 20 August 2026, the packages did not rely on an npm preinstall or postinstall lifecycle hook. The loader ran when the module itself was evaluated. One import anywhere in the dependency graph, including through a transitive dependency, was enough.

The bundled payload was RedShell, the native Linux implant added to the commercially marketed RedC2 command-and-control framework in version 4.0. RedC2 also includes Red Agent, an LLM-backed control layer that converts an operator’s natural-language goal into a sequence of commands for an active beacon.

The supply-chain entry point and the AI layer solve different problems for the attacker. The npm package supplies access. RedShell supplies persistence, credential theft, execution and network pivoting. Red Agent reduces the expertise and manual effort needed to use those capabilities after compromise.

The utilities were functional

The package cluster masqueraded as small, dependency-free tools for date calculations. TrendAI found genuine code for grouping values by day, measuring differences between dates and calculating streaks. A developer testing the advertised function could therefore receive the expected result.

Each package also contained the same Linux ELF implant, stored under names such as math-core.bin, math-calc.bin, calc-cache.bin or calc-math.dat. Source comments framed the file as a native mathematics accelerator.

The reported packages and versions were:

• streak-metrics-math 1.0.0 and 1.0.1
• kit-map-vim 1.0.0
• streak-map-cache 1.0.0
• streak-map-kit 1.0.0
• map-streak-kit 1.0.0
• streak-cache-map 1.0.0
• streak-calc-metrics 1.0.0
• streak-calc-math 1.0.0
• streak-math-abz 1.0.0
• streak-metricsaz 1.0.0
• streak-math-metrics 1.0.0
• streak-metricazbd 1.0.0
• streak-metricsazb 1.0.0
• streak-kit-map 1.0.0

The usefulness of the surrounding code matters. Package review that looks only for obviously nonsensical source, broken documentation or a suspicious installation script can miss a package that behaves correctly while hiding its malicious action in the module entry point.

A single import became the execution point

The loader lived in dist/index.mjs. It re-exported the legitimate date helpers, then used an immediately invoked asynchronous function to locate the bundled binary, make it executable and verify its SHA-256 hash. If the digest matched the attacker’s build, Node’s child-process API launched the file without a shell and detached it from the importing process.

No exported function had to be called. The application did not need to exercise the package’s advertised feature. Evaluating the entry module was sufficient, and the detached process could survive after the Node process exited.

This bypasses a defensive assumption that has become common after repeated npm incidents. Running npm with --ignore-scripts blocks lifecycle scripts, but it does not stop JavaScript from performing side effects when an application later imports the installed module. The flag remains useful, but it is not a general-purpose malicious-package sandbox.

The distinction is also what separates this campaign from ChainDrop. ChainDrop turned trusted publishing workflows and an npm preinstall hook into a propagation mechanism. The RedC2 packages did not need an installation hook at all. Their trigger waited until the package entered a running dependency graph.

RedShell turned a package import into a post-exploitation platform

Once launched, the RedShell implant ignored broken-pipe signals, used a double fork to detach from the terminal and repeatedly attempted to reach a hardcoded command server. TrendAI identified 217.60.77.63 on TCP port 8792 as the primary endpoint in the analysed sample.

The main command channel ran inside TLS, but certificate verification was disabled. RedShell added its own static-key rotation and XOR routine over that connection. Other functions used separate and sometimes weaker channels. TrendAI observed plaintext HTTP for bulk exfiltration and payload retrieval, while some file transfers used the third-party Litterbox service.

The Linux implant exposed a broad command set:

• Interactive shell access, host discovery and process management
• Collection of SSH keys, browser credential stores and database information
• Bulk file collection and exfiltration
• Fileless ELF execution through memfd_create and shellcode execution in executable memory
• Loading of shared libraries and staged payloads
• SOCKS5 proxying, TCP port forwarding and cross-network shell tunnelling
• Persistence through cron, ~/.bashrc, user-level systemd services or XDG autostart entries

Those features make a developer workstation or CI runner more than a source of tokens. It can become a durable collection point and a route into other reachable systems. SSH material and cloud or build credentials can extend the compromise beyond the host where the package was imported, while tunnelling can turn that host into an internal relay.

Red Agent compresses the operator workflow

Red Agent is not the initial-access technique and it did not make the npm packages malicious. Its significance begins after a beacon exists.

TrendAI describes the feature as an LLM-backed command layer available inside the RedC2 terminal. An operator can specify an objective such as finding credentials or locating sensitive files. The system then breaks that objective into an ordered series of framework commands.

This is a practical form of offensive AI integration. The model has access to the active session’s command vocabulary and can act through the C2 framework rather than merely suggesting commands in a separate chat window. It therefore removes friction between intent and execution. That can help less experienced operators use a large post-exploitation toolkit and help experienced operators run repetitive workflows more quickly across multiple beacons.

Defenders should avoid overstating the autonomy. The published analysis demonstrates an operator-assistance layer, not an independently reasoning intrusion actor. The material change is workflow compression: a commodity framework can translate a goal into actions without requiring the operator to remember and sequence every command manually.

What defenders should check now

Removing a named package is necessary but not sufficient if it was ever imported on a Linux workstation, server or build runner. Teams should establish whether execution occurred and then treat exposed credentials as potentially compromised.

• Search resolved dependency data. Check lockfiles, package caches, software inventories and build artefacts for the exact package names and versions. Review transitive dependencies, not only packages deliberately selected by developers.
• Hunt for the bundled ELF. TrendAI published the SHA-256 digest 4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466. Look for executable files with the reported mathematics-themed names under node_modules and dist paths.
• Review process telemetry. Investigate Node processes that change permissions on bundled .bin or .dat files and then spawn detached native processes. Import-time execution will not appear as an npm lifecycle event.
• Inspect network evidence. Search for connections to 217.60.77.63, especially TCP ports 8792, 8060 and 8888, and unexpected uploads to litterbox.catbox.moe. Treat indicators as leads rather than permanent guarantees because infrastructure can change.
• Check persistence locations. Review user crontabs, shell initialisation files, user-level systemd units and XDG autostart entries on potentially exposed systems.
• Rotate secrets from a known-clean system. Prioritise SSH keys, repository and package-registry tokens, browser-held credentials, cloud credentials and CI/CD secrets available to the affected user or runner.

Longer term, package admission controls should inspect package contents as well as metadata and lifecycle scripts. Unexpected native binaries in a small JavaScript utility deserve scrutiny. So do top-level side effects in an entry module, especially permission changes, detached child processes and network access.

The known impact has limits

The public research identifies the package cluster, the analysed payload, infrastructure and technical capabilities. It does not provide a confirmed victim count or reliable exposure total. It also does not establish that every system which downloaded a package imported it on Linux and executed the implant.

That uncertainty should constrain claims about scale, but it does not reduce the defensive lesson. The malicious action sat beyond the point where many teams stop looking. Installation could appear uneventful, documented functions could work and provenance around the wider project could look ordinary. The decisive event was a later import.

A working dependency is not necessarily a safe dependency. With RedC2, the first sign of compromise could arrive only when normal application execution crossed the module boundary and quietly started a native backdoor.

Sources: TrendAI Research, 20 August 2026; The Hacker News, 21 August 2026.