Malicious npm Packages Deliver RedC2 Linux Backdoor in Supply Chain Attack
Researchers at TrendAI have uncovered a software supply chain attack leveraging malicious npm packages to deploy RedShell, a Linux implant tied to the RedC2 command-and-control (C2) framework. The campaign targets developers by disguising the payload within seemingly legitimate date and streak-calculation utilities, which function as advertised while covertly executing a hidden backdoor.
How the Attack Works
The compromised packages including streak-metrics-math, kit-map-vim, and other variants contain a trojanized entry file (dist/index.mjs) that automatically triggers upon import. Unlike traditional npm-based attacks, this method bypasses lifecycle hooks, meaning even --ignore-scripts flags fail to block execution. The loader checks for a bundled Linux binary, verifies its SHA-256 hash, and launches it as a detached process, evading detection.
Once active, RedShell establishes persistence via cron jobs, shell startup files, or user-level services, ensuring continued access even if the original package is removed. The implant can:
- Harvest SSH keys, browser credentials, and database files.
- Execute commands, open reverse shells, and transfer files.
- Enable SOCKS5 proxying, TCP port forwarding, and tunneling, turning infected hosts into network bridges.
- Leverage Red Agent, an AI-powered feature that translates plain-language requests into automated commands, accelerating reconnaissance and lateral movement.
Impact and Risks
The attack poses a significant threat to development environments, particularly those with access to source code repositories, cloud tokens, or production networks. Compromised hosts can serve as entry points for broader network infiltration, with stolen credentials enabling further exploitation. The use of plain HTTP for data exfiltration and payload delivery (via endpoints like 217.60.77.63:8060 and 217.60.77.63:8888) complicates detection, as traffic may blend with legitimate activity.
Indicators of Compromise (IoCs)
Security teams are advised to monitor for:
- Malicious npm packages: Over a dozen identified variants, including streak-metrics-math@1.0.0 and streak-cache-map@1.0.0.
- RedShell binary hash: 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466.
- C2 endpoints: 217.60.77.63:8792 (primary) and 127.0.0.1:8792 (fallback).
- File paths: Hidden binaries like /dist/internal/calc-cache.bin and persistence markers (~/.config/.rsvc).
- Network activity: Connections to litterbox.catbox.moe (file hosting) and api.ipify.org (IP lookup).
The attack underscores the growing sophistication of supply chain threats, where trusted dependencies become vectors for cross-platform malware. Organizations should prioritize isolating affected hosts, rotating exposed credentials, and reviewing persistence mechanisms to mitigate risks.
Source: https://cybersecuritynews.com/malicious-npm-packages/
npm TPRM report: https://www.rankiteo.com/company/npm-inc-
"id": "npm1787552649",
"linkid": "npm-inc-",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Software Development, Technology',
'type': 'Developers, Organizations using compromised '
'npm packages'}],
'attack_vector': 'Malicious npm packages',
'data_breach': {'data_exfiltration': 'Yes (via plain HTTP)',
'personally_identifiable_information': 'Browser credentials',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'SSH keys, browser credentials, '
'database files, source code '
'repositories, cloud tokens'},
'description': 'Researchers at TrendAI uncovered a software supply chain '
'attack leveraging malicious npm packages to deploy RedShell, '
'a Linux implant tied to the RedC2 command-and-control (C2) '
'framework. The campaign targets developers by disguising the '
'payload within seemingly legitimate date and '
'streak-calculation utilities, which function as advertised '
'while covertly executing a hidden backdoor.',
'impact': {'data_compromised': 'SSH keys, browser credentials, database '
'files, source code repositories, cloud tokens',
'identity_theft_risk': 'High (due to stolen credentials)',
'operational_impact': 'Compromised hosts can serve as entry points '
'for broader network infiltration',
'systems_affected': 'Linux systems, development environments'},
'initial_access_broker': {'backdoors_established': 'RedShell implant',
'entry_point': 'Malicious npm packages',
'high_value_targets': 'Development environments '
'with access to source code '
'repositories, cloud tokens, '
'or production networks'},
'lessons_learned': 'The attack underscores the growing sophistication of '
'supply chain threats, where trusted dependencies become '
'vectors for cross-platform malware.',
'post_incident_analysis': {'corrective_actions': 'Removing malicious '
'packages, rotating '
'credentials, enhancing '
'monitoring for IoCs',
'root_causes': 'Trojanized npm packages with '
'hidden backdoor functionality'},
'recommendations': 'Organizations should prioritize isolating affected hosts, '
'rotating exposed credentials, and reviewing persistence '
'mechanisms to mitigate risks.',
'references': [{'source': 'TrendAI'}],
'response': {'containment_measures': 'Isolating affected hosts, rotating '
'exposed credentials, reviewing '
'persistence mechanisms',
'enhanced_monitoring': 'Monitoring for IoCs such as malicious '
'npm packages, RedShell binary hash, C2 '
'endpoints, and network activity',
'third_party_assistance': 'TrendAI researchers'},
'title': 'Malicious npm Packages Deliver RedC2 Linux Backdoor in Supply Chain '
'Attack',
'type': 'Supply Chain Attack'}