How 14 Fake npm Packages Hid an AI-Powered Backdoor Called RedC2
The Small, Helpful Tool
Say you’re a developer and you need something small — a helper that just counts “streaks,” like how many days in a row someone kept up a habit. It’s a tiny job, so instead of writing it yourself, you go looking for a ready-made tool.
You find one on npm, the giant library that most JavaScript developers pull free tools from. It’s called streak-math-metrics. Nothing about it looks off. Clear description, working code, one line to install:
npm install streak-math-metrics
And here’s the unsettling part — it actually works. It counts streaks exactly the way it’s supposed to. But researchers at TrendAI, Trend Micro’s security arm, dug into it and found that this package, along with 13 others just like it, was carrying something extra along for the ride.
How the hidden backdoor activates — based on TrendAI’s technical report, published August 20, 2026.
The Secret Passenger
Buried inside the package was a second file with a deliberately boring name, something like math-core.bin, dressed up to look like a “native math accelerator” that speeds up calculations. It’s the kind of filename you’d scroll straight past without a second thought.
What makes this one nasty is how little it takes to set off. TrendAI found that the package’s entry file, dist/index.mjs, does double duty as a loader. It quietly re-exports the real date-math code you actually wanted, while also launching the hidden binary the instant the module loads — no install script, no extra click, nothing exported you’d need to call.
Which means you don’t even have to install one of these packages yourself to get hit. If anything your project depends on — buried several layers down in your dependency tree — pulls one of these in, the backdoor still runs.
Meet RedC2 — What The Backdoor Actually Does
That hidden file drops a backdoor called RedShell, the Linux piece of a bigger toolkit named RedC2. RedC2 is sold openly on cybercrime forums as a “command-and-control” framework — software built to let one person remotely run many infected machines at once, across Windows, macOS, and Linux.
Once it’s on a Linux machine, RedShell can do quite a lot:
- Open up an interactive shell and run commands, just like someone sitting right at the keyboard
- Go looking for saved SSH keys and browser-stored passwords
- Read through, move, and grab files
- Dig in so it survives a reboot
- Run entirely in memory, so it leaves less of a trail on disk
- Act as a proxy to quietly reach other machines on the same network
It’s sold right out in the open, $99.99, on a clearnet site called “Red Offsec,” with terms of service claiming it’s for authorized security testing only. That kind of promise is worth nothing once it’s smuggled inside trojanized packages like these.
RedC2’s public development history, as described in TrendAI’s report and cybercrime-forum listings.
The AI Twist: Red Agent
Here’s what really sets version 4.0 apart: it ships with a built-in AI assistant called Red Agent. Instead of typing out detailed technical commands by hand, an operator can just describe what they want in plain language, and the AI handles turning that into the exact steps the beacon needs to run.
TrendAI put it plainly — an operator types a natural-language request, and the framework translates it into real, working command sequences. That’s the part worth sitting with: it means someone doesn’t need deep technical skill anymore to pull off a complex, multi-stage intrusion. The AI fills in that gap for them.
How Red Agent turns a plain-language request into real attack commands.
All 14 Packages Found
Here’s the full list TrendAI identified, all carrying the hidden RedShell payload (published at version 1.0.0, with streak-metrics-math also seen at 1.0.1):
| Package name | Package name | Package name |
| streak-metrics-math | kit-map-vim | streak-map-cache |
| streak-map-kit | map-streak-kit | streak-cache-map |
| streak-calc-metrics | streak-calc-math | streak-math-abz |
| streak-metricsaz | streak-math-metrics | streak-metricazbd |
| streak-metricsazb | streak-kit-map |
Source: TrendAI / Trend Micro technical report, cited in The Hacker News, August 21, 2026.
Not an Isolated Incident
This wasn’t a one-off. Just days before this report, a separate attack hit three Rust packages — arrayref, internment, and append-only-vec — by sneaking a malicious dependency into the mix that ran automatically the moment developers built their software.
TrendAI also flagged infrastructure overlaps between this campaign and earlier attacks on the Mastra and Axios npm packages, both previously tied to a North Korea-based threat group. So there’s a real chance these aren’t isolated incidents at all, but pieces of a bigger, ongoing pattern.
What This Means For You
- “Free and open source” doesn’t mean “safe.” Anyone can publish a package to npm, and nobody checks it for you.
- You don’t have to install a bad package yourself to get burned. A dependency buried a few layers deep is enough.
- Before you add a new package, take thirty seconds to check how new it is, how many people actually use it, and whether the code is easy to read.
- AI is now working both sides of this fight. Red Agent is a clear example of how it can lower the bar for running a serious attack.
- If you’re building detection tooling: watch for unexpected child processes spawned from Node, and for files inside node_modules that suddenly gain execute permissions out of nowhere.
Frequently Asked Questions
Am I affected if I never installed any of these 14 packages myself?
Possibly, yes. TrendAI found that no install script is needed — just importing the package, even as a transitive dependency buried several layers down in your project, is enough to trigger the hidden binary. Check your full dependency tree, not just your direct package.json entries.
How do I check if one of these packages is in my project?
Run npm ls <package-name> for each name in the table above to see if it shows up anywhere in your dependency tree, direct or transitive. Tools like Socket.dev, npm audit, or your existing SCA/dependency-scanning tool should also flag these once their databases are updated.
What should I do if I find one installed?
Treat the machine as compromised, not just the package as “removed.” Rotate any credentials, SSH keys, and tokens that were on that machine, remove the package, and check for the .bin/.dat payload files and any unexpected outbound network connections before trusting the system again.
Is this only a Linux problem?
The specific RedShell beacon covered in this report targets Linux. But RedC2 as a whole is cross-platform, with separate Windows and macOS beacons that carry their own capabilities — the Windows version additionally includes UAC bypass and antivirus tampering, which the macOS version lacks.
Does this mean AI made the attack itself more dangerous?
Not in terms of new technical capability — RedShell’s actual functions (shell access, credential theft, persistence) aren’t new territory. What Red Agent changes is who can operate the tool effectively. By turning plain-language requests into working attack commands, it lowers the skill floor needed to run a multi-stage intrusion.
Is RedC2 itself illegal to sell?
RedC2 is marketed as a red-team / penetration-testing tool, sold openly for $99.99 with terms of service prohibiting unauthorized use. That framing is common for dual-use offensive security tools and doesn’t, by itself, make the sale illegal — but it also does nothing to stop the tool from being hidden inside malicious packages like the ones in this report.