AI-Powered RedC2 Backdoor Hidden in 14 npm Packages

Fourteen npm packages published as calendar and streak-tracking utilities have been identified as trojanized, delivering RedC2 4.0 — a Linux implant with AI-assisted command-and-control — to any developer or CI system that installs them. The discovery comes from TrendAI, Trend Micro’s AI-integrated threat research arm, reported Thursday by The Hacker News.

The delivery mechanism is efficient. When the malicious module loads, it locates a bundled binary within the package, marks it executable, and launches it as a detached background process. No additional user interaction required beyond the initial install. The implant runs independently of the npm module from that point. The “AI-assisted” designation on the C2 component refers to adaptive communication timing — the beacon intervals adjust to avoid detection heuristics that flag regular, predictable outbound connections.

The packaging choice is deliberate. Calendar integration and habit-streak tracking are common in developer toolchains — low-friction, single-purpose utilities that get added without much scrutiny. They’re frequently indirect dependencies, pulled in by other packages rather than explicitly chosen. That means they can reach environments where nobody specifically approved them and nobody is actively watching for them.

The broader trend here is harder to ignore than any single incident. Backdoored Rust crates delivered an infostealer at build time two days ago. Sixteen fake RubyGems were doing the same thing to browser credentials and crypto wallets three days before that. The package registries — npm, crates.io, RubyGems — have different maintainers and different tooling, but the exploitation model is identical: publish something useful-looking, wait for the install count to accumulate, collect what the runtime environment has access to.

RedC2 4.0 specifically targets Linux, which puts CI/CD pipelines, server deployments, and Linux developer workstations at the center of the risk surface. Build environments in particular are high-value targets — they typically have access to source code, environment variables, cloud credentials, and signing keys. A trojanized package that fires at module load time survives the build step and runs wherever the build artifact runs, which can extend far past the developer’s own machine.

Practical steps:

• Review any npm packages in active projects that provide calendar or streak-tracking functionality; cross-check against TrendAI’s indicators of compromise once the full package list is published by Trend Micro
• Audit CI/CD pipeline dependencies — not just direct dependencies but the full transitive tree
• If your organization uses a private registry with an allow-list, verify the allow-list covers transitive dependencies, not just top-level installs
• Lockfiles (package-lock.json, yarn.lock) reduce exposure but don’t eliminate it for packages that were already installed before the trojanization was detected

The same mistake, different ecosystem, different week. Until the registries themselves implement more aggressive pre-publish binary scanning — or organizations implement consistent dependency review gates — the pattern will repeat.

Source: The Hacker News, 2026-08-21, citing TrendAI/Trend Micro research. Related: GitHub Actions Injection Found in Snowflake .NET Repo.