14 Functional npm Packages Embed RedC2 4.0 Linux Beacon via dist/index.mjs Loader

The packages deliver a functional math or calendar utility while the entry file extracts and executes a bundled ELF binary named math-core.bin or calc.bin from dist/ or dist/internal/. The beacon registers with a remote C2 via check-in message, opens /bin/sh, harvests SSH keys and browser credentials, and supports SOCKS5 proxying plus in-memory ELF execution. No CVE has been assigned and downloads remain unquantified in public telemetry.

Trend Micro documented the loader behavior and RedC2 4.0 feature set; cross-reference with Hack Forums posts by MarlboroMan shows version 4.0 advertised June 2026 after 3.0 in January, confirming sustained commercial development. The AI-assisted C2 claim lacks independent packet or binary confirmation, yet the framework's BOF, .NET, and shellcode execution capabilities match prior RedC2 marketing.

Supply-chain campaigns have repeatedly exploited transitive dependencies; these packages follow the same pattern seen in earlier npm compromises where a single import anywhere in the graph triggers payload execution. The decision to ship working utilities increases dwell time before detection.

Operators should scan package-lock.json for the listed versions and block the observed C2 domains; Red Offsec marketing indicates further platform expansions are likely within the next release cycle.