Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant to Steal Credentials and Pivot Networks

Malicious npm packages are being used to place a Linux backdoor inside calendar and streak-calculation tools. The packages deliver legitimate date functions, making the malicious code easy to miss.

The danger begins when an affected module is imported. The loader makes a bundled Linux program executable and starts it in the background, without an install script or suspicious function call.

TrendAI researchers identified the campaign as a software supply chain attack that delivers RedShell, the Linux implant associated with the RedC2 command-and-control framework.

TrendAI said in a report shared with Cyber Security News (CSN) that it shows how a harmless-looking dependency can become an entry point into a production environment. The impact extends beyond the initial host.

The implant can collect credentials, explore a network, move traffic through an infected machine and pull in extra tools. That puts source code, cloud access and internal services at risk when a poisoned package reaches a trusted build chain.

Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant

The affected packages pose as small, dependency-free utilities for date math. Their advertised features work as expected, while a hidden binary is presented as a native helper.

This blend of useful code and concealed execution is why malicious npm package campaigns remain difficult for teams to spot early.

The entry file, dist/index.mjs, runs automatically as the module loads. It checks for the binary, changes its permissions and verifies its SHA-256 value before starting it as a detached process.

Since it does not rely on lifecycle hooks, using --ignore-scripts does not stop this route to execution. A direct or transitive import can trigger the implant, even if the developer never selected the package.

Similar techniques have shown how configuration file supply chain attacks can sidestep controls built around familiar npm lifecycle scripts.

The binary is RedShell, a native Linux component introduced in RedC2 4.0. The implant uses separate plain HTTP paths for data theft and payload downloads.

The report describes RedShell as capable of taking SSH keys, browser-stored credentials and database-related files.

It can create persistence through cron, shell startup files, user-level services or desktop autostart entries. These actions can give intruders a durable foothold after the original package has been removed.

AI Assistance Raises the Stakes

RedC2 includes Red Agent, a feature that turns a plain-language request into a sequence of commands for an infected system.

An operator can ask for reconnaissance or credential collection rather than manually issuing every step. The AI layer can make follow-on activity faster and easier to coordinate.

RedShell can run commands, open a reverse shell, transfer files and inspect users, processes and network settings. It supports SOCKS5 proxying, TCP port forwarding and tunnelling, features that can turn one compromised Linux host into a bridge toward otherwise unreachable systems.

The risk resembles recent CI credential theft incidents in which developer environments provided valuable access beyond one workstation.

Security teams should check lockfiles, package caches and build artifacts for the affected package names and versions.

Any host that imported one should be treated as potentially compromised: isolate it, rotate exposed credentials, inspect persistence locations and review outbound connections. Removing a dependency alone may not remove a launched implant or undo stolen secrets.

Defenders should watch for Node processes changing bundled .bin files to executable, unexpected background children from dependency directories, and traffic to the listed addresses and ports.

Tightening dependency approval, pinning versions, reviewing package contents and limiting build-system permissions reduce the blast radius. The case reinforces lessons from cross-platform malware delivery attacks where native payloads hide behind trusted development tools.

For incident response, prioritize hosts with access to source repositories, deployment keys, cloud tokens or production networks.

Search endpoint telemetry for the RedShell hash and filenames, block confirmed malicious communications where appropriate, and preserve logs before rebuilding systems. The evidence points to a threat designed to establish a route for network compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant to Steal Credentials and Pivot Networks appeared first on Cyber Security News.