Executive Summary
Trend Micro's enterprise threat intelligence division (TrendAI) has discovered a coordinated supply-chain campaign involving 14 malicious npm packages designed to silently deploy an advanced Linux implant known as RedShell, integrated with the RedC2 4.0 command-and-control (C2) framework. Masquerading as routine calendar, mapping, and mathematical metric utilities (e.g., streak-metrics-math, streak-map-cache, kit-map-vim), the packages execute immediately upon module loading or import, completely bypassing traditional post-install script scanning mechanisms. The delivered RedC2 4.0 framework incorporates artificial intelligence capabilities into its operational infrastructure, automating initial target reconnaissance, adjusting network beaconing jitter, and streamlining lateral movement tasks for human operators.
Deep-Dive Technical Analysis
The threat actors engineered an infection chain optimized to evade automated CI/CD security filters:
* Import-Time Execution (No Install Hooks): Most software composition analysis (SCA) tools look for suspicious preinstall or postinstall lifecycle scripts in package.json. In this campaign, the packages contain valid JavaScript exports that trigger execution the instant the package is imported or referenced anywhere in the dependency graph (e.g., require('streak-map-kit') or an ES6 import).
* Decoupled Binary Execution: The module identifies a bundled pre-compiled binary (RedShell) hidden inside the package assets, sets executable permissions via fs.chmodSync(), and launches it as a detached background process (child_process.spawn({ detached: true, stdio: 'ignore' })). This severs the binary's process tree from the parent Node.js runtime, evading process-tree container monitoring.
* AI-Augmented C2 Infrastructure (RedC2 4.0): The dropped RedShell implant establishes encrypted TLS communications with an upstream RedC2 4.0 server. The framework leverages machine-learning models to analyze host telemetry, summarize environment variables, categorize developer source trees, and dynamically alter beacon frequencies to match baseline enterprise traffic patterns.
* Targeted Discovery: The malware specifically targets developer workstations and build runners, scraping SSH configuration files (~/.ssh/id_rsa, known_hosts), cloud credential stores (~/.aws/credentials, Azure CLI tokens), and Docker sockets.
Industry Impact
* Developer Workstation Compromise: Because software engineers routinely install testing dependencies, a single transitively pulled package can grant root-level backdoor access to development laptops and continuous integration (CI) runners.
* AI-Assisted Operational Speed: Incorporating LLMs into C2 infrastructure drastically reduces the time required for threat actors to parse harvested credentials, identify sensitive intellectual property, and pivot into corporate cloud environments.
* Evasion of Traditional SCA: Tools relying solely on static manifest inspection or CVE databases fail to catch import-time binary drops without runtime sandboxing.
Recommendations and Mitigations
1. Package Hash and Name Blocklisting: Immediately remove and block the 14 identified packages (streak-metrics-math, kit-map-vim, streak-map-cache, streak-map-kit, map-streak-kit, streak-cache-map, streak-calc-metrics, streak-calc-math, streak-math-abz, streak-metricsaz, streak-math-metrics, etc.) across internal npm proxies and package lockfiles.
2. Runtime EDR on Developer Endpoints: Deploy endpoint protection configured to alert on Node.js parent processes spawning detached native ELF binaries from /node_modules/ paths.
3. Strict Internal Registry Controls: Implement private registry proxies (such as Verdaccio, Nexus, or Artifactory) enforcing strict package-allowlists and mandatory peer-review approvals for newly published external open-source libraries.
4. Credential Isolation and Secret Scanning: Prevent storage of long-lived API keys or plaintext credentials in developer home directories, leveraging short-lived federated credentials and hardware security keys (FIDO2).