14 npm packages hide AI-powered Linux backdoor in plain sight
Security teams are racing to update registries after researchers uncovered 14 npm packages that masquerade as innocuous utilities but secretly drop an AI-enhanced Linux backdoor. The packages, posing as calendar and streak tracking tools, install RedC2 4.0, a fourth-generation implant that blends into routine system activity and uses AI-assisted command-and-control to evade detection.
When the malicious module loads, it locates an embedded binary, marks it executable, and launches it as a detached background process. The payload then opens a persistent channel to attackers, who can issue commands and exfiltrate data while the host system continues to operate normally—making the breach hard to spot without specialized monitoring.
A growing trend in open-source sabotage
This isn’t the first time attackers have weaponized npm’s popularity to smuggle backdoors. Supply-chain attacks on package registries have surged as developers increasingly rely on third-party code. By disguising malware as everyday utilities, threat actors exploit trust in familiar package names to slip past automated scanners and human reviews.
Why it matters
Supply-chain attacks on npm continue to escalate in sophistication, forcing organizations to scrutinize every dependency and adopt stricter registry vetting. The AI-assisted nature of RedC2 4.0 signals a new shift: implants that can adapt to defenses in real time, raising the bar for detection and response teams. Teams that treat every open-source package as potentially hostile—and verify it before deployment—will be the ones best positioned to limit the fallout.
Source: The Hacker News. AI-assisted editorial synthesis — TechnoExpress.