Affected Systems

14 npm packages (streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, streak-kit-map) versions 1.0.0-1.0.1. Packages masquerade as calendar and streak utilities. Targets Linux systems; RedC2 4.0 also supports Windows and macOS beacons.

Exploitation Status

Active supply chain attack. Malicious packages published to npm registry. RedC2 4.0 framework actively marketed on cybercrime forums since June 2026 for $99.99. Payload executes automatically on module import without install hooks.

Business Impact

Automatic execution on import means any application with transitive dependencies on these packages is compromised. RedC2 4.0 provides full remote access including interactive shell, credential theft (SSH keys, browser data), file operations, persistence, in-memory ELF execution, SOCKS5 proxying, and lateral movement. AI-assisted Red Agent component lowers skill barrier for attackers to execute complex multi-stage intrusions. Functional package code masks malicious behavior, increasing likelihood of adoption.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit package-lock.json and node_modules for the 14 identified packages (streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, streak-metricazbd, streak-metricsazb, streak-kit-map) and remove if present
  • Search Linux systems for suspicious binaries named math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, or calc-mapping.bin in application directories
  • Monitor outbound network connections from Node.js processes for C2 beacons; hunt for check-in messages containing system enumeration data
  • Implement npm package integrity checks using tools like npm audit, Snyk, or Socket.dev to detect malicious dependencies before deployment
  • Rotate credentials and SSH keys on any system that imported these packages; assume compromise of browser credentials, system information, and sensitive files

---

# Threat Actor Context

Actor Profile

TrendAI is the threat actor attributed by Trend Micro's enterprise cybersecurity business as the discoverer and analyst of this campaign. The actual threat actor behind the malicious npm packages is linked to a cybercrime operator using the alias "MarlboroMan," who advertised RedC2 4.0 on Hack Forums in June 2026. MarlboroMan operates under the brand "Red Offsec" and markets RedC2 as a cross-platform C2 framework for $99.99, claiming it is designed for red team professionals. The framework has been under active development since at least August 2025 (version 2.0), with version 3.0 released in January 2026 and version 4.0 in June 2026. The actor's stated motivation is providing offensive security tooling with evasion as a core principle, though the delivery via trojanized npm packages indicates malicious intent beyond legitimate red team operations.

TTPs (Tactics, Techniques, Procedures)

The campaign employs supply chain compromise via 14 trojanized npm packages masquerading as calendar and streak utilities (T1195.002 - Compromise Software Supply Chain). The malicious packages execute a bundled Linux binary (RedShell beacon) as a detached background process upon module load, requiring no install hooks—transitive imports are sufficient for payload execution (T1059 - Command and Scripting Interpreter). The RedShell Linux beacon establishes C2 communication (T1071 - Application Layer Protocol), performs system discovery (T1082), credential harvesting including SSH keys and browser credentials (T1555 - Credentials from Password Stores, T1552.004 - Private Keys), file operations (T1005 - Data from Local System), persistence mechanisms, in-memory ELF execution (T1620 - Reflective Code Loading), SOCKS5 proxying (T1090 - Proxy), and network pivoting (T1021 - Remote Services). The Windows beacon variant includes UAC bypass (T1548.002), antivirus tampering (T1562.001 - Impair Defenses), and lateral movement capabilities. The framework supports staged payload delivery, in-memory execution of BOFs, .NET assemblies, and shellcode, plus host-to-host tunneling.

Targets & Patterns

The primary targets are software development organizations and individual developers who consume npm packages, particularly those working in Node.js ecosystems. The malicious packages specifically masquerade as date utilities and math accelerators, suggesting targeting of developers building applications requiring calendar, metrics, or mathematical functionality. The Linux-focused payload (RedShell beacon) indicates targeting of Linux-based development environments, CI/CD pipelines, and server infrastructure common in software development shops. The use of functional packages that deliver promised features while hiding malicious payloads demonstrates sophisticated targeting designed to evade developer scrutiny during dependency evaluation. The low barrier to entry provided by the AI-assisted Red Agent component suggests the framework may appeal to less sophisticated threat actors, potentially broadening the victim pool across various sectors beyond the initial software development compromise vector.

Historical Context

RedC2 has been under active development since at least August 2025 with version 2.0. Version 3.0 was released in January 2026, and version 4.0—which introduced the RedShell Linux beacon—was advertised on Hack Forums in early June 2026 by the threat actor "MarlboroMan." This represents a rapid development cycle with three major versions released within approximately 10 months. The framework's evolution shows increasing sophistication, with version 4.0 adding AI-powered command execution via the Red Agent LLM-backed component and expanding cross-platform support to include Linux alongside existing Windows and macOS capabilities. The current campaign follows closely after a coordinated supply chain attack affecting three legitimate Rust crates, indicating a broader trend of supply chain compromise targeting developer ecosystems. The marketing of RedC2 on cybercrime forums while simultaneously maintaining a clearnet presence under "Red Offsec" with terms of service prohibiting unauthorized access represents a common pattern of plausible deniability among commercial offensive security tool vendors.

Defensive Recommendations

  • Implement npm package vetting processes including dependency tree analysis to detect unexpected native binaries in JavaScript packages, particularly those disguised as math accelerators or performance utilities
  • Monitor for suspicious process execution patterns where Node.js spawns detached background processes immediately upon module load, especially binaries with names like math-core.bin, calc-math.dat, or similar naming conventions located in dist/ directories
  • Deploy endpoint detection rules to identify RedShell beacon indicators including outbound C2 check-in messages containing system enumeration data, interactive shell access via /bin/sh, and in-memory ELF execution (T1620)
  • Scan development and production Linux environments for credential harvesting activity targeting SSH keys (~/.ssh/) and browser credential stores (T1555, T1552.004), particularly when correlated with recent npm package installations
  • Implement network monitoring to detect SOCKS5 proxy establishment (T1090) and host-to-host tunneling activity originating from developer workstations or CI/CD infrastructure, which may indicate RedC2 network pivoting operations