RedC2 4.0 Hidden in 14 npm Packages

This is a serious shift from malicious install scripts to stealthy module-load execution, making ordinary dependency review insufficient.

• –A single import can launch a bundled Linux binary in the background.
• –Legitimate calendar and streak utilities disguise the malicious payload.
• –AI-assisted command generation makes commodity C2 tooling more flexible and accessible.
• –Developers should audit lockfiles, inspect package contents, monitor child processes, and isolate CI runners.
• –Any exposed credentials or tokens should be rotated from a clean environment after investigating affected hosts.