14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Threat actors embedded the RedC2 4.0 Linux backdoor inside 14 convincingly named npm packages — masquerading as legitimate calendar and streak utilities — to compromise developer environments through a classic supply chain attack. Because developers inherently trust public package registries, malicious packages can slip through unnoticed, granting attackers persistent terminal access, file transfer capability, and in-memory execution without triggering traditional endpoint alerts. The use of AI-assisted command-and-control infrastructure raises the sophistication bar, making detection and attribution significantly harder. This incident underscores that the software supply chain is now a primary attack vector, and unvetted open-source dependencies represent a critical, often underestimated, risk to any organization's security posture.