Trend Micro’s TrendAI research team disclosed on August 20, 2026 that 14 npm packages published under names like streak-metrics-math and kit-map-vim were trojanized to drop a Linux backdoor called RedC2 4.0 the moment they’re imported, no install script or postinstall hook required. The packages posed as small date and streak-tracking utilities, worked exactly as advertised, and quietly launched a bundled binary in the background on any machine that pulled them in, even as a transitive dependency.
npm has since pulled all 14 packages. Checking the registry directly, each one now resolves to a single 0.0.1-security placeholder version, which is npm’s standard marker for a confirmed malicious takedown.
How the Backdoor Hid Inside a Math Library
According to TrendAI’s writeup, each package shipped legitimate date-math code sitting right next to a hidden Linux ELF binary with a name like math-core.bin or calc-mapping.bin, framed as a native performance accelerator. On import, the loader checks the filesystem for the binary, marks it executable with fs.chmodSync, verifies its integrity against a SHA-256 hash, and spawns it as a detached background process. No preinstall or postinstall entry appears in package.json, which is exactly what most dependency-scanning tools flag first, so this attack skipped the trip wire entirely.
What RedC2 4.0 Actually Does
RedC2 is a commercial command-and-control framework that’s been sold on hacking forums since June 2026, built for Windows, macOS, and Linux. TrendAI’s report describes version 4.0’s Linux implant as giving an operator interactive shell access, file operations, credential harvesting, persistence, and network pivoting, plus an AI component called Red Agent that turns plain-language instructions into beacon command sequences. TrendAI published two indicators worth checking against your own logs: a command-and-control IP at 217.60.77.63, and a SHA-256 hash of 4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466.
What Node.js Teams Should Do This Week
- Grep
package-lock.jsonoryarn.lockacross every repo for the 14 package names TrendAI listed, including as transitive dependencies, not just direct ones. - Search build and production servers for the binary filenames TrendAI documented (variants of
math-core.bin,calc-cache.bin,calc-mapping.bin) and for outbound connections to 217.60.77.63. - If a match turns up anywhere, treat that machine’s credentials, API keys, and SSH access as compromised and rotate them, not just remove the package.
- Pin dependency versions and review anything pulled in as a low-download, single-maintainer utility package before it lands in a lockfile.
This is the kind of exposure that’s easy to miss on a site that was built once and hasn’t had its dependency tree looked at since. If you inherited a Node.js backend from a previous developer or agency, it’s worth having someone audit the full dependency graph as part of any web application development work, not just the code you wrote yourselves. It’s a similar lesson to what we covered when a WordPress plugin vendor’s supply chain got compromised back in mid-August: the risk isn’t always in your own code, it’s in what your code pulls in.
