Malware Now Ships Its Own AI Agent

Trend Micro found 14 npm packages installing a Linux implant whose built-in LLM agent turns plain English into post-exploitation commands.

Trend Micro's TrendAI research unit found 14 npm packages that install a Linux backdoor with its own AI agent built in. The packages, disguised as calendar and streak-tracking date utilities, work exactly as advertised while also dropping a beacon called RedShell for a commercial framework named RedC2 4.0. RedC2's command layer, Red Agent, turns an attacker's plain English instructions into concrete post-exploitation actions on the machine that imported them. Most 2026 security coverage is about attackers exploiting AI coding agents that are already running on a target. This is the mirror image: the agent ships inside the malware, so one compromised import buys a natural-language-operable foothold instead of a fixed script.

The trojan loader lives in the package entry file, dist/index.mjs, across all 14 packages, including streak-metrics-math, kit-map-vim, and map-streak-kit. Researcher Aliakbar Zahravi wrote that the loader "re-exports the date helpers and launches the bundled implant as soon as the module loads, with no install hook and no exported function required," so one import anywhere in a dependency tree is enough, including a transitive one nobody chose directly. On load, the script confirms a bundled binary is present, marks it executable with a chmod call, checks its SHA-256 hash against a value hardcoded in the loader to guard against tampering, then spawns it as a detached background process that keeps running even after the Node process that launched it exits. No postinstall script runs and no function needs to be called; the payload fires the moment Node evaluates the module.

Sources: Prompting the Payload: How an npm Supply Chain Attack Delivers RedC2 (TrendAI), 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 (The Hacker News)

This post argues that a new dependency deserves the same admission discipline as a new tool granted to an agent, and that argument favors a category we build in: TLM Forge gates AI-assisted changes, dependency bumps included, behind independent review before they ship. The facts below stand on their own regardless of that interest.

Inside the RedC2 4.0 supply chain attack

RedC2 is sold on Hack Forums and on a clearnet storefront branded Red Offsec, priced at $99.99 by a seller using the handle MarlboroMan. Version 4.0, released June 1, 2026, is the first to add Linux support alongside the existing Windows and macOS builds, and the Linux beacon it deploys, RedShell, gives an operator interactive and reverse shells, file transfer, process and user enumeration, SOCKS5 and TCP port forwarding for pivoting into internal networks, and persistence through cron, bashrc, systemd, or XDG autostart entries. The framework also supports in-memory execution of ELF binaries, shellcode, Beacon Object Files, and .NET assemblies, so a payload can run without writing a second-stage file to disk for antivirus tools to catch. On the 14 trojanized packages specifically, RedShell was set to collect SSH keys and configuration files, browser-stored credentials and cookies, and database configuration files: the exact material that turns one compromised laptop into access for whatever that laptop can reach.

Sources: 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 (The Hacker News), Prompting the Payload: How an npm Supply Chain Attack Delivers RedC2 (TrendAI)

A Linux-only payload is not a narrow target. Most CI/CD runners, container base images, and cloud servers run Linux, so the machine an npm install reaches is as likely to be a build pipeline or a production host as a developer laptop. A credential-stealing beacon that lands during an automated install on a CI runner can walk straight into whatever secrets that pipeline holds: deploy keys, cloud credentials, and registry tokens, the exact blast radius a single compromised import was never supposed to have.

Red Agent: the malware's own LLM

Red Agent is what separates RedC2 4.0 from an ordinary C2 kit, not the implant itself. It is an LLM-backed command layer, reachable through the framework's own /_ra endpoint, that takes a plain English request from the operator and runs what the vendor documentation calls keypoint analysis: breaking one sentence of intent into an ordered chain of concrete beacon commands. An operator no longer needs to know the right sequence of enumeration, credential harvesting, and pivoting commands for a given target. They describe the outcome in words, and Red Agent produces the steps.

Sources: Prompting the Payload: How an npm Supply Chain Attack Delivers RedC2 (TrendAI)

Why a natural-language C2 lowers the bar for a serious intrusion

A natural-language interface over post-exploitation commands is not a new capability so much as a lower floor for using existing ones. Sonatype's 2026 State of the Software Supply Chain report counted more than 800 packages linked this year to the state-sponsored Lazarus Group, about 97 percent of them on npm, running five-stage payload chains that combine droppers, credential theft, and persistent remote access; droppers showed up in roughly 98 percent of those packages and secrets exfiltration in roughly 64 percent. That level of chaining used to require operational sophistication most crews did not have. Red Agent packages a version of that same chaining logic into a $99.99 kit anyone on Hack Forums can buy, and lets a typed request stand in for the sequencing knowledge an operator used to need.

Sources: 2026 State of the Software Supply Chain: Open Source Malware (Sonatype)

The broader npm pattern this fits into

RedC2 is one campaign inside a much larger trend. Sonatype identified more than 454,600 new malicious open source packages in 2025 alone, pushing the cumulative count past 1.233 million across npm, PyPI, Maven Central, NuGet, and Hugging Face, and found that more than 99 percent of that malware landed on npm specifically. Fourteen packages is a small slice of that volume. What makes this slice different is not the count. It is that the payload now ships with a layer built to make itself easier to operate, which scales an intrusion in a different way than more packages or more downloads ever could.

Sources: 2026 State of the Software Supply Chain: Open Source Malware (Sonatype)

What to check before a new package lands in your lockfile

• Entry-file execution, not just install scripts: read what runs when the module loads, not only what runs in a postinstall hook. RedC2 needed neither an install hook nor an exported function call, so an ignore-scripts flag alone would not have stopped it.
• Bundled binaries: a pure JavaScript date or math utility that ships a compiled binary alongside it is a mismatch between what the package claims to do and what it actually contains.
• Permission and process calls in a file that should only export functions: a chmod call followed by a spawn call inside a small utility library has no legitimate reason to exist.
• Working as advertised is not clearance: the RedC2 packages passed a smoke test, since the date and streak math they promised did in fact work. Functional correctness and safety are two different checks.
• Transitive exposure: the risky import does not have to be a direct dependency. Anything reachable through a dependency tree can carry the same loader, so audit what a new top-level package pulls in, not only the package itself.

Vetting a dependency is the same discipline as vetting an MCP server

The instinct this calls for is not new, only newly urgent. How to vet MCP servers before you trust them covers the same problem one layer up the stack: a listing in a registry, whether that is the MCP Registry or the npm registry, proves who published a name, not what the code does with the access it receives. An MCP server sits where an agent tool call goes. An npm package sits inside the dependency tree that agent-generated code pulls from. Both are third-party code granted reach into a developer environment on the strength of a name and a description, and the RedC2 packages cleared that bar simply by working as advertised while also doing something else.

A different 2026 finding shows the other end of the same problem. The AI worm that spreads through agent memory files documented self-replicating prompts that jump agent to agent through editable memory files such as SOUL.md, infecting the next agent in a chain 55 percent of the time against 17 percent for the same payload in an ordinary file, in tests run by Anthropic and EPFL researchers. That worm needs an AI agent already running to carry it forward. RedC2 needs nothing of the sort. It plants its own command-following agent on a machine that may never have run AI tooling before, then waits for an operator to type a request. One threat spreads by riding an agent that already exists. The other brings its own agent along.

Sources: Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems (arXiv 2608.10218)

This is the gap TLM Forge is built to close, one step before the code itself. A new dependency changes what an agent, and the developer behind it, can reach, and it deserves the same independent review a generated diff receives before it merges. The convergence gate that blocks a change until reviewer agents agree the critical issues are at zero applies just as cleanly to adding a package as it does to changing a function: a dependency bump is the same admission decision, made one layer earlier.

The decision to trust or reject a package should not live only in one engineer's memory either. When a review flags a new dependency as suspicious, or clears it, the reasoning behind that call is exactly what the next engineer needs and rarely gets: which version was checked, what the reviewer looked at, why it passed or failed. That kind of record needs to live in whatever a team actually uses to track dependency decisions, not in one reviewer's memory. MemX, from the same team behind TLM Forge, is a private, persistent memory layer, but for an individual's own photos, documents, voice notes, and messages, not a team's engineering record.

None of this makes npm unusually dangerous, and RedC2 is not the first credential stealer to hide inside a working package. What is new is the layer bolted on top: a command interface that turns a successful compromise into something an attacker can operate by typing a request in English rather than by scripting each step in advance. The defense has not changed. Read the entry file before the module ever gets a chance to run, and treat the code inside any new dependency, and now potentially the agent riding along inside it, as running with whatever access the process that imported it already has. That has always been true of every dependency a build ever pulled in. RedC2 4.0 is simply the clearest demonstration yet of what an attacker can do with that access once an LLM is the one giving the orders.