TrendAI, Trend Micro's enterprise research arm, reported on 21 August 2026 that 14 npm packages posing as calendar and utility tools were carrying RedC2 4.0, a Linux backdoor.

The package names are variations on a theme — streak-metrics-math, streak-map-cache, kit-map-vim, streak-calc-math and similar — almost all published at version 1.0.0. The binaries sat in dist/ or dist/internal/ under innocuous names like math-core.bin, calc-math.dat and calc.bin.

No install hook, which is the point

Most npm supply-chain attacks use a postinstall script, and most defensive advice is built around that — audit install scripts, disable them in CI, review what runs at install time.

This does not use one. Researcher Aliakbar Zahravi describes it precisely: the package re-exports the legitimate date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function needing to be called.

TrendAI's summary of the consequence is the sentence to take away: a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.

You do not have to use the package. You have to be somewhere underneath something that imports it. That is the same mechanic as the Rust crate whose build script ran at compile time, arriving at the same place from the opposite direction — one runs when you build, one runs when you load, and neither waits for you to call anything.

What RedC2 4.0 is

A commercial product. It was advertised in June 2026 on Hack Forums by a seller calling himself MarlboroMan, described as built for evasion, and priced at $99.99.

The Linux beacon does what a modern implant does:

  • Interactive shell through /bin/sh
  • System discovery and file operations
  • SSH key and browser credential harvesting
  • In-memory ELF execution, so the second stage never lands on disk
  • SOCKS5 proxying and network pivoting
  • Persistence

The Red Agent

RedC2 4.0 ships with a component called Red Agent, and this is the part worth sitting with.

Per TrendAI, an operator types natural-language prompts and the framework translates them into actionable command sequences. The pitch is that operators of varying skill can run complex multi-stage intrusions.

Notice what that is and is not. It is not an autonomous attacker. Nobody is claiming the framework decides what to do. It is a translation layer — the same thing every other tool is bolting on — placed between a person who knows what they want and a set of capabilities they could not previously drive.

That lowers the floor rather than raising the ceiling. The skilled operator was never blocked by remembering command syntax. The buyer at $99.99 was.

Read it alongside the five-agency advisory describing AI-written tooling for Siemens PLCs: in both cases the AI is doing authorship or translation, not autonomy, and in both cases what it removes is the requirement to be an expert.

What to do

  • Search your lockfiles for the package names, not just your direct dependencies. Transitive is the whole point.
  • Stop relying on install-script controls alone. Disabling postinstall does nothing here.
  • Treat any Linux build agent that resolved these as compromised, and rotate its SSH keys first — that is what the beacon collects.
  • Watch for outbound SOCKS5 and unexplained shell processes under your node user on build hosts.
  • Pin and commit lockfiles, and prefer a mirrored registry for production builds.

What is not established

  • Download counts. Not published.
  • Whether npm has removed the packages. Not stated in the reporting.
  • Who deployed it. RedC2 is sold commercially, so its users are not one actor.
  • How effective Red Agent actually is. The capability is advertised by its seller and described by researchers; no evaluation of it has been published.