Cybersecurity researchers have discovered that certain npm packages are being used to install a Linux backdoor, disguised within calendar and calculation tools. These packages include legitimate date functions, making the malicious code difficult to detect.
Unveiling the Threat
The threat arises when a compromised module is imported, causing a bundled Linux program to execute quietly in the background. This occurs without any explicit install script or suspicious function call, complicating early detection efforts.
TrendAI researchers identified this as a software supply chain attack deploying RedShell, a Linux implant linked to the RedC2 command-and-control framework. Their report, shared with Cyber Security News, highlights how seemingly benign dependencies can serve as gateways into production environments, potentially affecting more than just the initial host.
Mechanics of the Attack
The Linux implant collects credentials, explores networks, and redirects traffic through infected machines, putting source codes, cloud access, and internal services at risk once a compromised package is part of a trusted build chain.
These affected packages present themselves as simple utilities without dependencies for date calculations. While they function as advertised, they also contain a hidden binary posing as a native helper, complicating detection.
Advanced Features of RedC2
The RedShell binary, a native Linux component introduced in RedC2 4.0, uses plain HTTP paths for data theft and payload downloads. It is capable of extracting SSH keys, browser-stored credentials, and database files, and can establish persistence through cron jobs, shell startup files, or user-level services.
RedC2’s AI-powered Red Agent converts plain-language requests into command sequences, automating reconnaissance and credential collection processes, thus simplifying follow-up activities for attackers.
Mitigation and Prevention
Security teams are advised to inspect lockfiles, package caches, and build artifacts for any affected package names and versions. Any host that imported such packages should be considered compromised, necessitating isolation, credential rotation, and a thorough review of persistence locations and outbound connections.
To mitigate risks, organizations should enhance their dependency approval processes, pin package versions, review package contents, and limit build-system permissions, thereby reducing the potential impact of such attacks.
Conclusion
This incident underscores the increasing sophistication of cyber threats and the necessity for vigilant monitoring of software supply chains. By integrating threat intelligence into security operations, organizations can better defend against such complex threats.
