2026-08-29 · view entry permalink →
Fourteen trojanized npm packages drop RedC2 4.0's RedShell Linux implant from a module-load-time loader that needs no install hook, defeating --ignore-scripts entirely
TrendAI (Trend Micro) Research published a technical analysis, dated 2026-08-20, of a cluster of fourteen trojanized
npm packages — small, functional calendar/streak date-math utilities such as streak-metrics-math, kit-map-vim
and streak-map-cache — that each bundle a Linux ELF binary alongside genuine, working date-helper code
(TrendAI Research, 2026-08-20).
The package's loader re-exports the genuine helpers so the package works as advertised, then runs an async IIFE
(immediately invoked function expression) evaluated at module load: it marks the bundled binary executable, verifies
its hash against a hardcoded constant, and spawns it detached so it outlives the importing Node process
(TrendAI Research, 2026-08-20).
No install hook or exported function call is involved, so --ignore-scripts provides no coverage, and a single
transitive import anywhere in a dependency graph — even one the developer never directly selected — is sufficient to
trigger execution (TrendAI Research, 2026-08-20).
The dropped binary is RedShell, the native Linux implant for RedC2 4.0, a modular, actively-developed cross-platform
(Windows/macOS/Linux) command-and-control framework marketed on Hack Forums. On execution, RedShell ignores SIGPIPE,
double-forks to daemonize, and connects to a hardcoded primary C2 host over TCP with aggressive keepalive tuning,
wrapping the session in TLS with certificate verification explicitly disabled — accepting any server certificate,
self-signed or otherwise, without validation — and TLS 1.2 enforced as the minimum version
(TrendAI Research, 2026-08-20).
A persistent per-host installation ID is cached in a dotfile under $HOME so re-infection state survives restarts.
RedShell exposes a broad Linux-native command set to the operator: interactive shell execution, SSH-key and
browser-credential harvesting, database discovery, bulk exfiltration over HTTP or to third-party file-sharing
services, fileless ELF execution via memfd_create, arbitrary shellcode execution via mmap, dlopen-based
shared-library loading, SOCKS5 proxying and TCP port forwarding, and cross-network reverse-shell tunnelling brokered
through the C2 server; persistence is established through cron, .bashrc, a user-level systemd service, or an XDG
autostart entry (TrendAI Research, 2026-08-20).
The framework additionally ships an LLM-backed component RedC2's own documentation calls Red Agent — a different
tool from Wiz's own similarly-named "Red Agent" autonomous red-teaming tool, an unrelated defensive research
product — exposed via a /ra command in the beacon terminal, described as trained on the framework's command set
to break a single natural-language operator prompt into an ordered chain of beacon commands
(TrendAI Research, 2026-08-20).
Detection concept: process-creation telemetry showing a Node.js/npm-installed package's module import immediately spawning a detached, double-forking child process that opens an outbound TLS session accepting an invalid or self-signed certificate without validation — legitimate npm packages that bundle native binaries (for example via prebuilt node-gyp addons) do so at install time through a documented hook, not as a side effect of a plain import with no exported function called. Triage: a package with a bundled native binary that is invoked only from install-time hooks is routine; one invoked from a plain module-load side effect, with no install hook present at all, is the discriminator.
One import anywhere in the dependency graph is sufficient, including from a transitive dependency the developer never selected.
Certificate verification is explicitly disabled via SSL_VERIFY_NONE, meaning the malware will accept any server certificate without validation, allowing the C&C operator to use self-signed or otherwise invalid certificates freely.
RedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into framework beacon commands. It is exposed through /ra in any beacon terminal, in both the web UI and the EXT client.