Trojanized npm packages deliver RedC2 4.0 Linux backdoor

Trend Micro has uncovered 14 malicious npm packages that pose as calendar and streak utilities but deliver an AI-powered Linux backdoor called RedC2 4.0. The packages execute the payload upon import, without requiring an install hook.

The backdoor, which communicates with a remote server, enables post-exploitation activities such as system discovery, credential theft, and in-memory execution. RedC2 4.0, marketed on cybercrime forums, includes an LLM-driven component called Red Agent that translates natural-language commands into actions.