Active Exploitation Alert: Critical Supply Chain Attack via 14 Trojanized npm Packages Drops RedC2 4.0 AI-Assisted Linux Backdoor

Executive Summary

A critical supply chain attack has been identified involving 14 trojanized npm packages that surreptitiously deploy the RedC2 4.0 Linux backdoor, a sophisticated implant featuring AI-assisted command-and-control (C2) capabilities. These packages, masquerading as legitimate calendar and streak utilities, exploit the trust inherent in the open-source ecosystem to achieve widespread distribution. Upon import—regardless of whether the package is a direct or transitive dependency—the malicious payload is executed, establishing covert persistence and enabling advanced post-exploitation activities. The attack leverages the npm ecosystem’s reach, targeting developer environments and Linux server infrastructure globally, and demonstrates a significant escalation in the technical sophistication of supply chain threats.

Threat Actor Profile

The campaign is attributed to a threat actor operating under the alias MarlboroMan, who has actively marketed RedC2 4.0 on underground forums such as Hack Forums. Infrastructure and tactics, techniques, and procedures (TTPs) observed in this campaign overlap with previous supply chain attacks linked to North Korean advanced persistent threat (APT) groups, notably those behind the Mastra and Axios incidents. While direct attribution remains circumstantial, the operational patterns, infrastructure reuse, and targeting profile are consistent with North Korean-linked supply chain operations. The actor demonstrates a high degree of technical acumen, leveraging both advanced malware development and social engineering to maximize the impact of the campaign.

Technical Analysis of Malware/TTPs

The infection vector is the npm package import mechanism itself. The 14 malicious packages, including streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, and streak-kit-map, contain a loader in dist/index.mjs that re-exports legitimate utility functions while surreptitiously launching a bundled Linux binary. This binary, typically named math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin, is dropped into the dist/ or dist/internal/ directories and executed in the background.

The payload, RedC2 4.0 (also known as RedShell Linux Beacon), is a multi-platform backdoor with the following capabilities: interactive shell access via /bin/sh, system discovery, file operations, SSH key and browser credential theft, persistence via boot or logon initialization scripts, in-memory ELF execution, SOCKS5 proxying, and network pivoting. Upon execution, the implant establishes outbound connections to attacker-controlled C2 infrastructure, registering the compromised host with a "check-in" message containing system metadata.

A distinguishing feature of RedC2 4.0 is its AI-assisted C2 layer, branded as Red Agent. This component leverages large language models (LLMs) to translate natural-language operator prompts into actionable beacon commands, enabling automated and context-aware post-exploitation activities such as lateral movement, credential dumping, and network reconnaissance. The C2 infrastructure supports multi-beacon operation, network visualization, host-to-host tunneling, and staged payload delivery, significantly enhancing the threat actor’s operational agility.

The loader’s stealth is notable: no install hook or explicit function call is required, and the packages remain fully functional, increasing their adoption and complicating detection. The attack chain is mapped to several MITRE ATT&CK techniques, including Supply Chain Compromise (T1195.002), Command and Scripting Interpreter: JavaScript/Node.js (T1059.007), Boot or Logon Initialization Scripts (T1547), Credentials from Web Browsers (T1555.003), SSH Keys (T1552.004), Application Layer Protocol: Web Protocols (T1071.001), Exfiltration Over C2 Channel (T1041), Masquerading (T1036), and In-memory Execution (T1620).

Exploitation in the Wild

The malicious packages were published to the npm registry and functioned as advertised, which fostered trust and facilitated their adoption in both direct and indirect dependency chains. Upon import, the backdoor is activated, and the compromised system begins beaconing to attacker infrastructure. Trend Micro TrendAI and independent researchers have confirmed live exploitation and observed active C2 communications. The RedC2 4.0 toolkit is being actively marketed and sold on cybercrime forums, and there is evidence of overlap with prior APT supply chain attacks involving Mastra, Axios, and malicious Rust crates. No public proof-of-concept for the npm loader has been released, but the backdoor is available for purchase and use by other threat actors, increasing the risk of further exploitation.

Victimology and Targeting

The campaign targets organizations and individuals relying on the npm ecosystem for application development, with a particular focus on open-source software supply chains, developer environments, and Linux server infrastructure. The global reach of npm means that organizations in North America, Europe, and East Asia are especially at risk, though the attack is not geographically limited. The technical sophistication of the implant and the use of AI-assisted C2 suggest a focus on high-value targets, including technology companies, cloud service providers, and enterprises with significant Linux infrastructure footprints. The campaign’s reliance on functional, seemingly benign packages increases the likelihood of collateral impact across a broad range of sectors.

Mitigation and Countermeasures

Organizations are strongly advised to audit all Node.js projects for the presence of the identified malicious packages: streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, and streak-kit-map. Any affected packages should be removed and replaced immediately. Security teams should monitor for the presence of the associated binary artifacts—math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, and calc-mapping.bin—within project directories, and investigate any suspicious background processes spawned by Node.js applications.

Network monitoring should be implemented to detect outbound connections to unknown C2 infrastructure, particularly following the import of npm packages. Dependency trees should be reviewed for transitive imports of the affected packages, as the infection vector does not require direct usage. Endpoint detection and response (EDR) solutions should be configured to alert on the execution of unauthorized binaries and anomalous process behavior within development environments.

Organizations should also implement robust supply chain security practices, including the use of software composition analysis (SCA) tools, continuous monitoring of open-source dependencies, and the adoption of least-privilege principles for build and deployment pipelines. Regular threat intelligence updates and incident response exercises are recommended to ensure preparedness for future supply chain attacks.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM) and supply chain security. Our platform empowers organizations to continuously monitor, assess, and mitigate risks across their digital ecosystem, providing actionable intelligence and automated workflows to secure the software supply chain. For more information or to discuss how Rescana can help protect your organization, we are happy to answer questions at info@rescana.com.