14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

thehackernews.com/ ^ | Aug 21, 2026 | Ravie Lakshmanan

[BenLurkin]

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0.

"When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's enterprise cybersecurity business, said in a report published Thursday. "No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload."

...

What's notable about these packages is that they are functional and offer the promised functionality. But beneath that garb of date utilities is code designed to drop a Linux backdoor by framing it as a native math accelerator. The name of the file varies across the packages: math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin.

It's located either directly within the "dist/" or under "dist/internal/," but what it contains is the same: the RedShell Linux beacon for RedC2 4.0 that communicates with a remote Windows or Linux server to facilitate post-exploitation activities on the compromised host.

---

TOPICS: Computers/Internet
KEYWORDS:

[butlerweave]

the AI they’re sneaking in everywhere is wearing out our computers faster and we can’t afford to buy new or even old ones

[wafflehouse]

streak utilities

i thought that was more of an analog thing

[PGR88]

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

With news like this, I'm gonna take tomorrow off.

[Fai Mao]

Great, so nonw Linux needs an antivirus program

[ryderann]

I can’t figure out why computers would need those things.

[lee martell]

“Trojanized”?

[enumerated]

A reference to that giant horse the Greeks used to sneak into Troy.

[lee martell]

Ah yes. Hollowed and filled with the smuggled enemy.
I just usually don’t see it used as an active verb, but, here we are. Earth remains on it’s axis!

[Bob434]

is the average user susceptible to this? is it in an update?

[goorala]

No. You’ll be fine as long as you stay away from node.js/npm. npm has been a vector for bad packages for a long time, and they seem either unwilling or unable to do anything about it.

[Bob434]

i dont even know what npm is- I’m not real savvy on linux-

[yesthatjallen]

Node Package Manager, npm, is a package manager for the JavaScript programming language, primarily used to manage dependencies for Node.js applications. It allows developers to install, update, and manage libraries and tools needed for their projects.

[ArcadeQuarters]

Sure package managers are giant security holes but they save sooo much time. ¯\_(ツ)_/¯

[MikelTackNailer]

I read the article twice and got:

1. it creeps in disguised as math-related files,

2. there’s versions for Linux, Microsoft and Apple,

3. Chrome-based browsers are a primary target,

4. the writer told us jack squat on how to deal with it.

But 20 years after leaving I.T. work I’m not up as I’d like to be. Any suggestions other than “don’t use the internet”?

[KarlInOhio]

I just usually don’t see it used as an active verb

[yesthatjallen]

too small. can’t read it.

[dayglored]

Yikes. Sigh.