Fourteen trojanized npm packages drop RedC2 4.0's RedShell Linux implant from a module-load-time loader that needs no install hook, defeating --ignore-scripts entirely
TrendAI (Trend Micro) Research published a technical analysis, dated 2026-08-20, of a cluster of fourteen trojanized
npm packages — small, functional calendar/streak date-math utilities such as streak-metrics-math, kit-map-vim
and streak-map-cache — that each bundle a Linux ELF binary alongside genuine, working date-helper code
(TrendAI Research, 2026-08-20).
The package's loader re-exports the genuine helpers so the package works as advertised, then runs an async IIFE
(immediately invoked function expression) evaluated at module load: it marks the bundled binary executable, verifies
its hash against a hardcoded constant, and spawns it detached so it outlives the importing Node process
(TrendAI Research, 2026-08-20).
No install hook or exported function call is involved, so --ignore-scripts provides no coverage, and a single
transitive import anywhere in a dependency graph — even one the developer never directly selected — is sufficient to
trigger execution (TrendAI Research, 2026-08-20).
The dropped binary is RedShell, the native Linux implant for RedC2 4.0, a modular, actively-developed cross-platform
(Windows/macOS/Linux) command-and-control framework marketed on Hack Forums. On execution, RedShell ignores SIGPIPE,
double-forks to daemonize, and connects to a hardcoded primary C2 host over TCP with aggressive keepalive tuning,
wrapping the session in TLS with certificate verification explicitly disabled — accepting any server certificate,
self-signed or otherwise, without validation — and TLS 1.2 enforced as the minimum version
(TrendAI Research, 2026-08-20).
A persistent per-host installation ID is cached in a dotfile under $HOME so re-infection state survives restarts.
RedShell exposes a broad Linux-native command set to the operator: interactive shell execution, SSH-key and
browser-credential harvesting, database discovery, bulk exfiltration over HTTP or to third-party file-sharing
services, fileless ELF execution via memfd_create, arbitrary shellcode execution via mmap, dlopen-based
shared-library loading, SOCKS5 proxying and TCP port forwarding, and cross-network reverse-shell tunnelling brokered
through the C2 server; persistence is established through cron, .bashrc, a user-level systemd service, or an XDG
autostart entry (TrendAI Research, 2026-08-20).
The framework additionally ships an LLM-backed component RedC2's own documentation calls Red Agent — a different
tool from Wiz's own similarly-named "Red Agent" autonomous red-teaming tool, an unrelated defensive research
product — exposed via a /ra command in the beacon terminal, described as trained on the framework's command set
to break a single natural-language operator prompt into an ordered chain of beacon commands
(TrendAI Research, 2026-08-20).
Detection concept: process-creation telemetry showing a Node.js/npm-installed package's module import immediately spawning a detached, double-forking child process that opens an outbound TLS session accepting an invalid or self-signed certificate without validation — legitimate npm packages that bundle native binaries (for example via prebuilt node-gyp addons) do so at install time through a documented hook, not as a side effect of a plain import with no exported function called. Triage: a package with a bundled native binary that is invoked only from install-time hooks is routine; one invoked from a plain module-load side effect, with no install hook present at all, is the discriminator.
One import anywhere in the dependency graph is sufficient, including from a transitive dependency the developer never selected.
Certificate verification is explicitly disabled via SSL_VERIFY_NONE, meaning the malware will accept any server certificate without validation, allowing the C&C operator to use self-signed or otherwise invalid certificates freely.
RedC2 ships with an AI assistant called Red Agent, an LLM-backed command execution layer that turns natural-language intent into framework beacon commands. It is exposed through /ra in any beacon terminal, in both the web UI and the EXT client.
ATT&CK mapping
10 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Execution TA0002
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1059.004Command and Scripting Interpreter: Unix Shell
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Persistence TA0003
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Privilege Escalation TA0004
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Stealth TA0005
T1620Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Credential Access TA0006
T1552.004Unsecured Credentials: Private Keys
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Command and Control TA0011
T1090.001Proxy: Internal Proxy
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
T1573Encrypted Channel
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.