npm Calendar Packages Conceal RedShell, the Linux Beacon of RedC2 4.0

Importing the Package Is Enough to Trigger the Malware

Researchers at TrendAI, Trend Micro’s enterprise division, identified a group of trojanized npm packages posing as utilities for calendars, dates, and so-called “streak” tracking. The discovery was disclosed on August 21, 2026.

The modules perform their advertised functions, but also contain the RedShell Linux beacon, a component of the RedC2 4.0 command-and-control framework. The payload executes automatically when the module is loaded.

No postinstall script or explicit function call is required. Simply importing the package is enough—even indirectly through a transitive dependency.

This mechanism significantly expands the attack surface. A developer may never have added one of the utilities directly to an application, yet still receive it through the dependency tree and trigger the malware when the Node.js process starts.

Packages and Binary Files to Look For

The identified packages and versions are:

• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]

The malicious code is embedded in dist/index.mjs, which preserves the legitimate utility exports while also acting as a loader.

When loaded, the file locates the binary component included in the package, changes its permissions to make it executable, and launches it as a detached background process. The application can therefore continue using the date-related functions without displaying obvious warning signs to the user.

The payload may use different filenames:

• math-core.bin
• math-calc.bin
• calc-math.dat
• calc-cache.bin
• calc.bin
• calc-mapping.bin

The files are located either directly in the dist/ directory or under dist/internal/. According to the analysis, their contents are the same RedShell Linux beacon for RedC2 4.0.

What RedShell Can Do on a Linux Host

RedShell collects basic information about the compromised system and sends it to the command-and-control infrastructure during its initial “check-in.” It then waits for instructions, executing them through /bin/sh and returning the results to the operator.

Observed capabilities include interactive terminal access, file management, data transfer, and the deployment of additional payloads. The beacon can also collect SSH keys and credentials stored in browsers.

Other available functions include:

• system and network reconnaissance;
• command execution;
• persistence mechanisms;
• in-memory execution of ELF files;
• Beacon Object File execution;
• execution of .NET assemblies and shellcode;
• SOCKS5 proxying;
• pivoting to other systems on the network.

This feature set goes well beyond basic remote access. An infected host can serve as a foothold for harvesting secrets, moving through the corporate network, relaying traffic, and loading additional components.

The Windows and macOS variants of RedC2 offer similar capabilities for host reconnaissance, user enumeration, file operations, and data collection. The Windows version also includes features for bypassing UAC, identifying and tampering with antivirus and endpoint detection products, executing code in memory, and facilitating lateral movement. These capabilities are not available in the macOS variant.

RedC2 4.0 Integrates an LLM-Based Agent

RedC2 4.0 is marketed as a cross-platform framework for Windows, macOS, and Linux. The actor known as “MarlboroMan” promoted it on Hack Forums in early June 2026, describing it as a product designed with evasion as a core objective.

Version 3.0 was sold in January, while version 2.0 was released in August 2025. RedShell Linux was introduced with version 4.0, indicating that the toolkit is under active development.

The framework is also sold through the clearnet website Red Offsec, where it is offered for $99.99 as a multi-OS, multilingual product. Its terms of service formally prohibit use against unauthorized systems, but such clauses do not prevent criminal misuse.

The package includes RedC2 EXT, a command-line extension, and Red Agent, a component based on a large language model. The latter allows operators to describe the desired activity in natural language, such as network reconnaissance or credential dumping.

The system converts that intent into command sequences to be sent to the beacons. This automation does not eliminate the need for initial access, but it can lower the expertise required to conduct complex, multi-stage post-compromise operations.

Risk to Developers and Corporate Infrastructure

The primary risk affects Linux systems that install one of the listed packages or receive it through an indirect dependency. Because the utilities function normally, detection may be delayed: the module produces the expected result while the loader runs the beacon in parallel.

A compromise can enable arbitrary command execution, credential theft, SSH key collection, file access, and the installation of additional payloads. In corporate environments, SOCKS5 proxying and pivoting can turn a single workstation or build server into an access point to internal systems.

The discovery also occurred shortly after another supply-chain attack involving three legitimate Rust crates: [email protected], [email protected], and [email protected].

In that case, the malicious proc-macro1 dependency could automatically execute cross-platform malware during Cargo builds. The component profiled the device, enumerated Chromium-based browsers, established persistence, contacted the attackers’ infrastructure, and downloaded additional payloads.

The maintainer’s publishing credentials are suspected to have been stolen. Infrastructure overlaps were also observed with previous supply-chain attacks targeting Mastra and Axios, which have been linked to North Korean actors.

Immediate Checks and Remediation

No specific patch is known for the affected npm packages. Organizations should block and remove them, checking both directly declared dependencies and the entire transitive dependency tree.

Priority checks include:

1. analyze package-lock.json, other npm lockfiles, and local caches;
2. search for suspicious files in the dist/ and dist/internal/ directories;
3. check for unusual Linux processes running in the background;
4. look for connections to unknown C2 infrastructure;
5. investigate persistence, unusual use of /bin/sh, SOCKS5 proxies, and pivoting;
6. isolate suspected hosts before remediation;
7. rotate passwords, tokens, SSH keys, and other secrets present on the systems;
8. preserve evidence for forensic analysis.

Preventing similar incidents requires version pinning, package allowlists, pre-installation scanning, and monitoring for changes published to repositories. Cargo environments should also apply specific scrutiny to proc-macro dependencies, as they can execute code during compilation.