Fourteen trojanized npm packages drop RedC2 4.0's RedShell Linux implant from a module-load-time loader that needs no install hook, defeating --ignore-scripts entirely

TrendAI (Trend Micro) Research published a technical analysis, dated 2026-08-20, of a cluster of fourteen trojanized npm packages, small, functional calendar/streak date-math utilities such as streak-metrics-math, kit-map-vim and streak-map-cache, that each bundle a Linux ELF binary alongside genuine, working date-helper code (TrendAI Research, 2026-08-20). The package's loader re-exports the genuine helpers so the package works as advertised, then runs an async IIFE (immediately invoked function expression) evaluated at module load: it marks the bundled binary executable, verifies its hash against a hardcoded constant, and spawns it detached so it outlives the importing Node process (TrendAI Research, 2026-08-20). No install hook or exported function call is involved, so --ignore-scripts provides no coverage, and a single transitive import anywhere in a dependency graph (even one the developer never directly selected) is sufficient to trigger execution (TrendAI Research, 2026-08-20).

The dropped binary is RedShell, the native Linux implant for RedC2 4.0, a modular, actively-developed cross-platform (Windows/macOS/Linux) command-and-control framework marketed on Hack Forums. On execution, RedShell ignores SIGPIPE, double-forks to daemonize, and connects to a hardcoded primary C2 host over TCP with aggressive keepalive tuning, wrapping the session in TLS with certificate verification explicitly disabled, accepting any server certificate, self-signed or otherwise, without validation, and TLS 1.2 enforced as the minimum version (TrendAI Research, 2026-08-20). A persistent per-host installation ID is cached in a dotfile under $HOME so re-infection state survives restarts. RedShell exposes a broad Linux-native command set to the operator: interactive shell execution, SSH-key and browser-credential harvesting, database discovery, bulk exfiltration over HTTP or to third-party file-sharing services, fileless ELF execution via memfd_create, arbitrary shellcode execution via mmap, dlopen-based shared-library loading, SOCKS5 proxying and TCP port forwarding, and cross-network reverse-shell tunnelling brokered through the C2 server; persistence is established through cron, .bashrc, a user-level systemd service, or an XDG autostart entry (TrendAI Research, 2026-08-20). The framework additionally ships an LLM-backed component RedC2's own documentation calls Red Agent, a different tool from Wiz's own similarly-named "Red Agent" autonomous red-teaming tool, an unrelated defensive research product, exposed via a /ra command in the beacon terminal, described as trained on the framework's command set to break a single natural-language operator prompt into an ordered chain of beacon commands (TrendAI Research, 2026-08-20).

Detection concept: process-creation telemetry showing a Node.js/npm-installed package's module import immediately spawning a detached, double-forking child process that opens an outbound TLS session accepting an invalid or self-signed certificate without validation, legitimate npm packages that bundle native binaries (for example via prebuilt node-gyp addons) do so at install time through a documented hook, not as a side effect of a plain import with no exported function called. Triage: a package with a bundled native binary that is invoked only from install-time hooks is routine; one invoked from a plain module-load side effect, with no install hook present at all, is the discriminator.