Fourteen functional npm utilities launched a native Linux backdoor when imported, bypassing install-hook defences and giving RedC2 an AI-assisted post-exploitation path.