New npm Malware RedC2 Steals Credentials, Pivots Networks

Key Takeaways

• Malicious npm packages are deploying the RedShell Linux implant, part of the RedC2 command-and-control framework.
• The packages masquerade as legitimate date and streak calculation utilities, making the embedded malicious code difficult to detect.
• RedShell can steal credentials, gather system information, establish persistence, and facilitate network pivoting, posing a significant supply chain risk.
• The RedC2 framework includes an AI-powered “Red Agent” feature that automates malicious operations, accelerating attacks.
• Organizations should treat any system that imported these packages as compromised, requiring isolation, credential rotation, and thorough forensic analysis.

A new software supply chain attack is leveraging seemingly innocuous npm packages to deliver a sophisticated Linux backdoor, dubbed RedShell, into development environments. These malicious packages, disguised as utility tools for calendar and streak calculations, embed a stealthy Linux implant that can steal credentials, explore networks, and facilitate further compromise, according to researchers at TrendAI.

The campaign represents a significant threat to development pipelines and production systems, as a single compromised dependency can open a gateway to sensitive corporate assets like source code repositories, cloud access credentials, and internal services. The sophisticated nature of the attack, which bypasses common detection methods, underscores the evolving risks in open-source ecosystems.

Malicious npm Packages Deploy AI-Powered RedC2 Linux Implant

The attack vector begins with the inclusion of malicious npm packages in a project. These packages offer legitimate date-related functionalities, which helps them blend in and avoid suspicion. However, they conceal a malicious Linux binary that is presented as a native helper. This combination of functional code and hidden execution makes such malicious npm package campaigns particularly challenging to detect early in the development lifecycle.

Upon importing an affected module, the loader, typically located at dist/index.mjs, automatically executes. This script checks for the embedded binary, adjusts its permissions, verifies its SHA-256 hash, and then launches it as a detached background process. Crucially, this execution method does not rely on standard npm lifecycle hooks, meaning that security measures like --ignore-scripts are ineffective at preventing the implant’s launch. This allows a direct or transitive import of the package to trigger the malware, even if the developer never explicitly selected the malicious dependency. Such tactics highlight how supply chain attacks can bypass security measures designed for traditional npm scripts.

The deployed binary is RedShell, a native Linux component first introduced in RedC2 4.0. This implant establishes command-and-control (C2) communication over separate plain HTTP channels for data exfiltration and payload downloads. TrendAI said in a report that RedShell is capable of stealing SSH keys, browser-stored credentials, and database-related files. It can also achieve persistence through various methods, including cron jobs, shell startup files, user-level services, or desktop autostart entries. These persistent footholds ensure that attackers maintain access even if the original malicious package is removed, making the impact of compromise far-reaching.

AI Assistance Raises the Stakes

The RedC2 framework is particularly notable for its “Red Agent” feature, which incorporates artificial intelligence. This AI component allows attackers to issue high-level, plain-language requests for tasks such as reconnaissance or credential harvesting, which the Red Agent then translates into a sequence of specific commands for the compromised system. This AI layer significantly streamlines and accelerates follow-on activities, making attacks faster and easier to coordinate for the threat actors.

RedShell’s capabilities extend beyond data theft and persistence. It can execute arbitrary commands, open reverse shells, transfer files, and meticulously inspect user accounts, running processes, and network configurations. Furthermore, it supports SOCKS5 proxying, TCP port forwarding, and tunneling. These advanced networking features enable a single compromised Linux host to serve as a bridge, allowing attackers to pivot deeper into otherwise isolated or unreachable segments of a network. This risk mirrors recent <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/2bb66705-d095-40d7-9d4c-8684240b25d8/Malicious-npm-Packages-Deploy-AI-Powered-RedC2-Linux-Implant-to-Steal-Credentials-and-Pivot-Networks.pdf?AWSAccessKeyId=ASIA2F3EMEYEZ6E63L5Q&Signature=PLe1XdyhpmHe8GMbcmlSUxy%2FmqA%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEB0aCXVzLWVhc3QtMSJIMEYCIQCUgTMuifMxad6kuqkjLbZ4iEyiRZ%2FR6CamtWefU9cjmgIhAKx3OL%2BUd%2Bvu8APtDOpF7ohTcWkyT4N2yVOLq1ebUOH8KvwECOb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQARoMNjk5NzUzMzA5NzA1Igw2bwP2Gt7z9shiX2Eq0AQbsaFHPdOPQQLaQDkbVbnP0TRcU9HAgfJz5Z18qAh6zioc2edNBnuoQQOt81mqjFkTs3ZCcDU9hxcMU3FFFXEXLMf%2B3y16Sis9U6nasqIR%2Fz3j5WZH7NDzmwnTmT1cF9uzAgFXc4XohNwrd0f5u%2F1a0K6FwNslKRzHOZQV%2FYWuLcTMheKpltaQ9BxoYa1Hr80S8DLRkR0FbwwPdufks9BUNCyBjf02%2Bl33iZivll18fD0ALihl6yhapAzhK%2FUYM0SjVkLnmHcDVgW4WxLMzJfpw3oa0RoMrJoy%2BYyfj8AxotLupZVig24aolm3W29TqG%2FILIKmLz8E9dhgJA%2F7ke2ysqrGDZbvgCHfwM4QtfgxRRxYh1f7JAyrLTJyFIFdHUl0

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.