14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Security researchers found functional-looking npm packages that are trojanized to drop and execute a bundled Linux backdoor (RedShell) — part of the RedC2 4.0 C2 framework — when imported; the report lists affected package names and bundled binary filenames, describes delivery/execution TTPs (automatic execution on module import), and summarizes RedC2 capabilities including credential theft, persistence, remote command execution, and an LLM-powered automation layer.