Loading story…
Researchers reported 14 trojanized npm packages posing as calendar, date, and streak utility libraries that secretly install the RedShell Linux beacon tied to the RedC2 4.0 command-and-control framework. The malicious code runs when a package is merely imported—including through transitive dependencies—by using dist/index.mjs to mark a bundled ELF binary as executable and launch it as a detached background process, avoiding traditional npm install hooks and rendering mitigations such as --ignore-scripts ineffective.
The implanted payload connects over TLS to a hardcoded C2 server at 217.60.77.63:8792 with certificate verification disabled and provides capabilities including persistence, credential theft, fileless execution, tunneling, SOCKS proxying, and data exfiltration. Researchers said RedC2 is marketed as a cross-platform toolkit for Windows, macOS, and Linux, and includes an AI-enabled Red Agent component that converts natural-language prompts into post-exploitation actions, underscoring how weaponized open-source packages can quietly deliver a full-featured backdoor and reduce the skill required for follow-on intrusions.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
TrendAI Research published a report detailing how dist/index.mjs in the malicious packages launched the bundled ELF implant at module import time without npm lifecycle hooks. The analysis also documented RedShell's C2 behavior, persistence methods, and Red Agent AI-assisted post-exploitation capability.
In early June 2026, a threat actor using the name MarlboroMan advertised RedC2 4.0 on Hack Forums as a command-and-control framework built for evasion.
TrendAI says RedC2 4.0 introduced native Linux support through the RedShell implant. This added a Linux beacon to the cross-platform command-and-control framework.
The report says RedC2 version 3.0 was sold in January 2026, showing continued development and commercialization of the framework.
Trend Micro's report states that RedC2 version 2.0 was released in August 2025.
Researchers discovered a cluster of npm packages masquerading as date, calendar, and streak utilities that secretly bundled and launched the RedShell Linux implant from RedC2 4.0. The packages remained functional while executing the payload when imported, including through transitive dependencies.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcetrendaisecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
Three malicious npm packages—`bitcoin-main-lib`, `bitcoin-lib-js`, and `bip40`—were discovered on the public npm registry, targeting JavaScript developers by masquerading as legitimate bitcoinjs project components. These packages, uploaded by a user named "wenmoonx," delivered a previously undocumented remote access trojan (RAT) dubbed NodeCordRAT. The infection chain began when developers installed either `bitcoin-main-lib` or `bitcoin-lib-js`, which executed a post-install script to fetch and install `bip40`, the package containing the actual malware payload. Once active, NodeCordRAT enabled attackers to steal browser credentials, API keys, and cryptocurrency wallet data, particularly targeting Chrome login databases, `.env` files, and MetaMask wallet information. NodeCordRAT is written in Node.js and uses Discord as its command-and-control (C2) channel, allowing attackers to remotely execute shell commands, take screenshots, and exfiltrate files from compromised developer systems. The malware is cross-platform, capable of fingerprinting infected hosts on Windows, Linux, and macOS, and uses Discord's API for covert data exfiltration. The campaign was identified by Zscaler ThreatLabz in November 2025, and all three malicious packages have since been removed from the npm registry. The attack highlights the ongoing risk of supply chain threats in open-source ecosystems, especially for developers handling sensitive credentials and production access.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026