RedC2 4.0 Linux Backdoor Unveiled in 14 Trojanized npm Packages

RedC2 4.0 Linux backdoor hides in npm calendar tools

Cybersecurity analysts at Trend Micro have uncovered a coordinated campaign that injects the RedC2 4.0 Linux backdoor into fourteen npm packages masquerading as calendar or streak‑tracking utilities. When a developer imports the compromised module, the code silently extracts a bundled binary, marks it executable, and spawns it as a detached background process.

“When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process,” the researchers noted.

The payload, a lean ↓ 12 KB AI‑assisted implant, connects to command‑and‑control servers that can issue arbitrary Linux commands, exfiltrate files, and even deploy additional malware. Its AI component adapts beacon intervals to evade typical network‑traffic baselines.

Impact on the JavaScript ecosystem

Package downloads surged before the malicious code was flagged, exposing thousands of projects to potential compromise. Developers are urged to verify package integrity against official repositories and to scan dependencies with tools such as Reuters security alerts or Bloomberg advisories.

Trend Micro recommends immediate removal of the affected packages, regeneration of SSH keys, and a review of system logs for anomalous activity.