A cluster of 14 npm packages disguised as calendar utilities has been caught dropping an AI-powered Linux implant called RedC2 4.0, according to Trend Micro’s TrendAI unit. The add-ons work as advertised, but a hidden loader fires the moment any module is imported.
The payload file, named math-core.bin, calc-math.dat, calc-cache.bin, or similar, lives in the dist directory and contains the RedShell beacon that links the compromised host to a remote Windows or Linux command server. The package entry file dist/index.mjs acts as the trojan loader, re-exporting the date functions and launching the implant as soon as the module loads.
No install hook is needed. A single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload, Trend Micro said. The packages include streak-metrics-math, kit-map-vim, streak-map-cache, map-streak-kit, and streak-calc-math among others, all published as version 1.0.0 or 1.0.1.
The discovery is another reminder that functional open source packages can hide malicious code. Developers should pin dependencies, audit new packages, and treat surprise transitive imports as a red flag.
