[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXNDVdV2_mU8waFM2CvXWkSICcbjpakNZv65ZcJJJqlo":3},{"article":4,"iocs":51,"watch_terms":57,"solutions":58,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"66166343-d554-4e2d-afb2-b66490360890","14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2","14-trojanized-npm-packages-drop-redc2-4-0-linux-backdoor-with-ai-assisted-c2-4b6135","Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. \"When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process,\" TrendAI, Trend Micro's","Researchers discovered 14 malicious npm packages disguised as calendar and streak utilities. These packages stealthily deliver RedC2 4.0, an AI-powered Linux backdoor, which communicates with a C2 server for post-exploitation activities. The RedC2 framework, marketed by a threat actor named 'MarlboroMan', offers advanced features like terminal access, file transfer, and in-memory execution.","14 trojanized npm packages deliver RedC2 4.0 Linux backdoor with AI-assisted C2.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002F14-trojanized-npm-packages-drop-redc2.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgvZpEOpS6_M3zQlIDwvD1wMhESnRAMTCz1nW2JFP__pGSVWOw28REaDTZ5lI7sdwvcRKSSUHI4sm1CUuWs6_gvOXE1c5BbvKnR75iyBl9Er1SckweDAxBEotnOlSikBeOE5WEBIIGlS74w4b85pvznpr3c4mj88LzLt-3pGr1HHXHQDg5v7T9FxdBSWSlK\u002Fs1600\u002Flinux-npm.jpg","2026-08-21T18:53:00+00:00","2026-08-21T22:00:16.236554+00:00",9,[17,20,23,26],{"name":18,"type":19},"RedC2 4.0","product",{"name":21,"type":22},"MarlboroMan","threat_actor",{"name":24,"type":25},"npm","technology",{"name":27,"type":25},"AI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,54],{"type":32,"value":18,"context":53},"AI-powered Linux backdoor",{"type":32,"value":55,"context":56},"RedShell Linux beacon","Linux variant of the RedC2 4.0 beacon",[18],{"controls":59,"vendors":145},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":119,"name":120,"problem":121,"products":122},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[123,129,137],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"trojanized-npm-packages-deliver-ai-powered-linux-backdoor-via-supply-chain-attack","Trojanized npm Packages Deliver AI-Powered Linux Backdoor via Supply Chain Attack","Threat actors embedded the RedC2 4.0 Linux backdoor inside 14 convincingly named npm packages — masquerading as legitimate calendar and streak utilities — to compromise developer environments through a classic supply chain attack. Because developers inherently trust public package registries, malicious packages can slip through unnoticed, granting attackers persistent terminal access, file transfer capability, and in-memory execution without triggering traditional endpoint alerts. The use of AI-assisted command-and-control infrastructure raises the sophistication bar, making detection and attribution significantly harder. This incident underscores that the software supply chain is now a primary attack vector, and unvetted open-source dependencies represent a critical, often underestimated, risk to any organization's security posture.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-218: Secure Software Development Framework (SSDF) — PW.4 (Reuse Existing Software Safely)","NIST CSF DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","NIST CSF ID.SC-4: Suppliers are routinely assessed","SLSA Supply Chain Security Framework — Build Integrity Level 3","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32 – Security of Processing (relevant where backdoored systems handle personal data)",{}]