Security researchers at Trend Micro have identified 14 trojanized npm packages disguised as legitimate calendar and habit-streak utilities that instead deploy a sophisticated Linux backdoor known as RedC2 4.0. The malware notably incorporates artificial intelligence to assist with command-and-control (C2) operations.

According to the findings, the malicious packages behave normally on the surface, offering the calendar or streak-tracking functionality users would expect. Beneath that facade, however, each package bundles a hidden binary payload designed to execute without the victim’s knowledge.

How the Infection Works

Researchers describe a straightforward but effective execution chain. “When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process,” Trend Micro’s AI research team explained. This approach allows the RedC2 4.0 implant to run persistently on infected Linux systems while avoiding immediate detection, since the malicious process is decoupled from the parent npm installation activity.

Because the trojanized packages present themselves as ordinary developer utilities, they are well positioned to slip past casual code review, particularly in environments where dependencies are pulled in automatically during build or CI/CD pipelines.

An AI-Assisted Backdoor

What distinguishes RedC2 4.0 from earlier implants is its integration of AI capabilities into its command-and-control operations. While full technical details of how the AI component is used remain limited in current disclosures, the branding and version numbering suggest an evolution from prior RedC2 variants, with this release specifically leveraging AI to enhance its C2 functionality on Linux targets.

Recommendations

  • Audit npm dependencies, especially calendar, streak, or productivity-themed packages, before installing in production or CI/CD environments.
  • Monitor for detached background processes spawned from Node.js module directories on Linux hosts.
  • Restrict outbound network connections from build and development systems where feasible.
  • Review package publisher history and download patterns for signs of recent, suspicious activity.

This incident underscores the continuing risk posed by the open source software supply chain, where trojanized packages can blend AI-driven capabilities with traditional backdoor techniques to target Linux-based development and production infrastructure.