Trend Micro researchers have uncovered 14 trojanized npm packages that looked and worked like legitimate calendar and streak-tracking utilities — but silently installed a sophisticated Linux backdoor the moment any project imported them. The implant, called RedC2 4.0, is sold on cybercrime forums for $99.99 by a threat actor calling themselves “MarlboroMan.” What makes it stand out is its AI layer: an add-on called Red Agent lets operators issue natural-language instructions (“gather SSH keys and beacon home”) that the framework automatically translates into multi-step attack commands, lowering the skill floor for anyone who buys it.
The infection mechanism is unusually aggressive. No install hook is required — a single import anywhere in a project’s dependency tree is enough to launch the implant as a background process. Once running, the Linux beacon connects to the attacker’s C2 server, profiles the infected host, collects SSH keys and browser credentials, establishes persistence, and waits for further instructions. The Windows version adds UAC bypass and antivirus tampering; all three platforms support file transfer, terminal access, and in-memory execution. Trend Micro’s research, which was published Thursday, identified the packages masking their binary payload as files named math-core.bin, calc.bin, or similar innocuous math-library names inside each package’s dist/ directory.
How to check if you’re affected
Affected versions of the malicious packages can be found by running npm ls in any Node.js project and checking for unfamiliar calendar or streak-related dependencies. If any of the package names match those in Trend Micro’s advisory, remove them immediately and rotate any credentials (SSH keys, browser-stored passwords) that the affected system may have had access to. Affected products include any Node.js application or development environment that imported one of the 14 identified packages.