Researchers from Trend Micro have identified 14 trojanized npm packages that disguise themselves as functional calendar and streak utilities. These packages execute a bundled binary to deliver RedC2 4.0, a Linux backdoor with AI-assisted command-and-control capabilities, potentially granting remote access to threat actors.

What should defenders do?

Users and organizations should immediately remove any installed packages matching the descriptions of trojanized calendar or streak utilities from npm. It is recommended to verify the legitimacy and source of all npm packages before installation. Monitoring system processes for unusual background binaries and maintaining updated security software are advised. Trend Micro has likely provided detections; users should ensure their security solutions are updated.

highMalware

Trojanized npm Packages Deploy RedC2 4.0 AI-Powered Linux Backdoor

14 malicious packages masquerading as calendar and streak tools discovered on npm registry

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

Trojanized npm Packages Deploy RedC2 4.0 AI-Powered Linux Backdoor

Key Takeaways

14 trojanized npm packages discovered delivering RedC2 4.0 Linux backdoor.
Packages masquerade as calendar and streak utilities to evade detection.
RedC2 4.0 features AI-assisted command-and-control capabilities.
Execution involves launching a bundled binary as a background process for persistence.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read