Executive Summary
TrendAI Research has identified a sophisticated supply chain attack targeting the npm ecosystem via a cluster of trojanized packages (e.g., streak-metrics-math). These packages provide legitimate date-utility functionality but bundle a malicious Linux ELF payload named RedShell. The loader is uniquely dangerous as it executes the payload via an async IIFE upon module import, bypassing traditional npm lifecycle hook protections like --ignore-scripts.
The RedC2 framework (v4.0+) introduced RedShell for Linux alongside 'Red Agent,' an LLM-backed orchestration layer that allows threat operators to convert natural-language prompts into complex post-exploitation tasks. The implant supports a wide array of capabilities, including credential harvesting, network pivoting via SOCKS5/TCP forwarding, and fileless execution using memfd_create.
This campaign signifies a growing trend in offensive AI integration, where LLMs lower the barrier for multi-stage intrusions. Affected organizations face risks of data exfiltration and long-term persistence through cron jobs, systemd services, and XDG autostart entries. Immediate sweeping for the C2 infrastructure at 217.60.77.63 is recommended.