TrendAI Finds 14 Trojanized npm Packages Dropping RedC2 4.0, an AI-Assisted Linux Backdoor

Trend Micro's threat-research arm, TrendAI, has disclosed 14 trojanized npm packages that pose as calendar and streak utilities while delivering a cross-platform Linux backdoor the company calls RedC2 4.0, one that TrendAI describes as shipping with an AI-assisted command-and-control layer.

The packages work as advertised, and that is the point: a developer who pulls one in gets a functioning date helper and, per TrendAI, a hidden implant alongside it. The disclosure, published August 21, 2026 and reported by The Hacker News, matters less for any single package than for what it signals: commodity offensive tooling with a natural-language control layer is now being pushed through the open-source registry that sits under most JavaScript and Node.js builds. This write-up stays in disclosure territory. It covers what TrendAI found, why the delivery method sidesteps a control many teams now rely on, and what a defender should check today. For implant internals and indicators of compromise, go to TrendAI's report.

What TrendAI Disclosed

TrendAI ties the campaign to 14 npm packages that each carry a bundled binary disguised as a math accelerator. The company's framing of the delivery is the single most important line for defenders: "No install hook function call is needed; a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload," TrendAI wrote. In plain terms, the code runs when the module is imported, not through the install-time hooks that npm hardening has increasingly targeted.

TrendAI describes the resulting implant, RedC2 4.0, as a cross-platform backdoor for Windows, macOS, and Linux, with a Linux beacon that the company says supports surveillance, credential theft, and payload loading. RedC2 itself is a commercial command-and-control framework sold on cybercrime forums, and TrendAI notes that the Linux component was introduced in this version. That is the part worth flagging: a paid, cross-platform toolkit now has a Linux implant, and it is being seeded through npm. Beyond that high-level shape, the mechanics belong in TrendAI's write-up, not here.

Why the Import-Time Trigger Matters

The reason this disclosure deserves a defender's attention is structural, not sensational. Much of the recent progress in npm safety has focused on install scripts: npm 12 ships with install scripts disabled by default, a change The CyberSignal covered as a genuine reduction in supply-chain risk. A payload that fires on import rather than on install slips past that specific mitigation, because importing a module is simply the ordinary act of using it.

TrendAI's observation that a transitive import is enough carries the sharper edge. A team can pull in the malicious code without ever directly listing one of the 14 packages in its own manifest, if some dependency deeper in the tree does. That is the nuance to carry into a standup: "we don't run untrusted install scripts" is necessary, and it is not sufficient against this one. The control that helps here is knowing your full dependency graph, direct and transitive, and being able to check it against a named list fast.

Who Should Care Most

The teams most exposed are JavaScript and Node.js shops that install small utility packages freely and run Linux on their build and developer hosts. That is a large population. TrendAI's disclosure centers on calendar and streak helpers, the kind of single-purpose dependency that rarely gets a second look in review, and the Linux beacon lands where continuous-integration runners and developer laptops increasingly sit. Organizations with deep transitive dependency trees are the sharpest case, because the import-time trigger does not require them to have chosen one of the 14 names directly. If your software bill of materials is thin or out of date, you cannot answer the one question that matters here: whether any of these packages resolved into a build over the past few weeks. Generating or refreshing that inventory is the precondition for every other step that follows.

The AI-Assisted C2 Angle, in Perspective

The headline feature is the AI-assisted command-and-control. TrendAI reports that RedC2 includes a large-language-model-backed component, marketed as Red Agent, that turns natural-language intent into framework commands. TrendAI's assessment of why that matters is worth quoting for the record: "This abstraction lets operators of varying skill levels execute complex, multi-stage intrusions efficiently."

The defensive reading is measured. An AI control layer does not hand the implant new capabilities on the endpoint; it lowers the skill required to operate what is already there. For a defender, the detection surface is unchanged. You are still watching for an unexpected process and unexpected outbound traffic on a host, whether a human or a model composed the operator's instructions. TrendAI does not name the specific model or API behind Red Agent, and neither will I. It fits a broader pattern The CyberSignal has tracked, from malicious npm packages harvesting AI developer tokens to self-propagating registry worms: the registry is the delivery layer, and AI is increasingly baked into what gets delivered.

The 14 Packages TrendAI Named

TrendAI published the full list, and The Hacker News reproduced it. If any of these appear in your dependency tree, direct or transitive, treat them as malicious and remove them:

• streak-metrics-math (1.0.0, 1.0.1)
• kit-map-vim (1.0.0)
• streak-map-cache (1.0.0)
• streak-map-kit (1.0.0)
• map-streak-kit (1.0.0)
• streak-cache-map (1.0.0)
• streak-calc-metrics (1.0.0)
• streak-calc-math (1.0.0)
• streak-math-abz (1.0.0)
• streak-metricsaz (1.0.0)
• streak-math-metrics (1.0.0)
• streak-metricazbd (1.0.0)
• streak-metricsazb (1.0.0)
• streak-kit-map (1.0.0)

What Defenders Should Do Now

The action is straightforward, and it maps to how this payload moves. Inventory your npm dependencies, then work outward from there.

Each step counters a specific part of the delivery. The dependency audit catches what a source-repository scan misses, because the risk here rides in a published package rather than in a suspicious commit. The CI/CD review closes the path by which a build quietly accepts a poisoned dependency. Endpoint monitoring is the backstop for anything that already ran, and it is where the Linux beacon TrendAI describes would surface as an unexplained process or connection. Removal plus credential rotation limits how far a single compromised workstation can carry the problem. This sits in the same family of hygiene The CyberSignal has urged through a run of registry incidents, including the ChainDrop worm that poisoned 444 npm packages.

What Is Not Yet Confirmed

Several points remain open, and a defender should hold them loosely. TrendAI's disclosure, as reported, does not publish install or download counts for the 14 packages, so the real-world exposure is unquantified. It is not confirmed whether npm has removed all 14 at time of writing. Attribution for this specific npm campaign is unsettled: RedC2 4.0 is a commercial framework, reportedly advertised by an actor using the handle "MarlboroMan" and sold through a storefront branded Red Offsec, which means the framework's seller and whoever weaponized these packages are not necessarily the same party, and the operator behind the npm campaign is not named. The specific model or API behind the Red Agent component is not disclosed, and no victim organizations are named. Treat all of that as reported-or-open, not settled.

My read: The AI-assisted C2 is what will get quoted, but it is not what should change your Monday. The detail that should is the import-time trigger, because it quietly retires the assumption that disabling install scripts covers you. This payload runs on the ordinary act of importing a module, transitively, which means the only reliable defense is knowing your full dependency graph and being able to check it against a named list quickly. The named list exists today. The unglamorous work of auditing against it is the whole job, and it is cheaper than discovering a Linux beacon the slow way.

Primary Documents

• TrendAI (Trend Micro): RedC2, an AI-powered Linux implant delivered via npm (Aug 21, 2026)
• The Hacker News: 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2