Reported by 2 outlets
RedC2 4.0 Linux Implant Delivered via Trojanized npm Packages
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.48 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting
gbhackers.com · 50d ago · August 24th, 2026
A cluster of trojanized npm packages is delivering the RedC2 4.0 Linux implant, providing operators with a pathway from a seemingly harmless dependency import to internal network pivoting via SOCKS5 proxies and TCP forwarding. The campaign disguises malicious code inside functional calendar and streak-calculation utilities, underscoring how supply-chain abuse can bypass controls focused only on […] The post RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
RedC2 AI-Powered Linux Malware Delivered Through Malicious npm Packages
cyberpress.org · 50d ago · August 24th, 2026
Security researchers have uncovered a supply-chain campaign distributing a native Linux implant tied to RedC2, a commercial multi-OS command-and-control (C2) framework marketed on Hack Forums, through a cluster of trojanized npm packages that represent a growing threat in npm supply chain attacks . The findings come from TrendAI Research, which analyzed the packages and reverse-engineered the embedded implant, dubbed RedShell Linux. RedC2 AI-Powered Linux Malware Uses npm Packages The malicious packages including streak-metrics-math , kit-map-vim , streak-map-cache , map-streak-kit , streak-calc-math , and at least eight other similarly named variants present themselves as dependency-free calendar and “streak” math utilities. Each contains genuinely functional date-math code in dist/internal/daymath.mjs , alongside a Linux ELF binary disguised as a “native math accelerator” under filenames such as math-core.bin , calc-cache.bin , or calc-mapping.bin , according to TrendAI. Malicious Package Directory Structure (Image Source: trendaisecurity.com) The entry file dist/index.mjs re-exports legitimate date helpers but also contains an asynchronous IIFE that silently launches the bundled binary on module load — no exported function call, preinstall, or postinstall hook required. This design defeats --ignore-scripts protections, since a single transitive import anywhere in a project’s dependency tree is enough to trigger execution, per TrendAI’s analysis. The loader verifies the bin