Fake npm Calendar Tools Hid an AI-Powered Linux Backdoor

Key points

• Researchers at Trend Micro's TrendAI unit found 14 malicious packages on npm, the code library used by millions of JavaScript developers.
• The packages pretended to be calendar and habit-tracker helpers but installed a hidden Linux backdoor called RedC2 4.0.
• RedC2 4.0 uses an AI model to help its operators write commands and analyse stolen data.
• On install, the packages quietly launched a bundled program in the background, giving attackers remote control of the machine.
• Developers who installed any of the flagged packages should treat the affected systems as breached and rotate credentials.

A fresh batch of poisoned developer packages has turned up on npm, the giant open-source code library that JavaScript programmers pull from every day. On the surface they looked like small helpers for calendars and daily streaks. Underneath, they were shipping a Linux backdoor with an AI assistant bolted on.

The find comes from TrendAI, the AI-security team at Trend Micro, and was first reported by The Hacker News. TrendAI counted 14 trojanized packages, meaning packages that carry hidden malicious code inside otherwise normal-looking software.

What exactly did the packages do?

Once a developer installed one of them, the package quietly ran a hidden program stored inside it. That program, RedC2 4.0, is a backdoor: software that lets a remote attacker send commands to your computer as if they were sitting at the keyboard.

"When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI wrote in its writeup. In plain English: the package finds the malicious file it brought with it, gives it permission to run, and starts it in the background where the user will not notice.

The target is Linux, the operating system that runs most cloud servers, developer laptops in some shops, and the machines behind a huge share of the internet's plumbing.

Why does the "AI" part matter?

RedC2 4.0 is the latest version of a remote-control tool that now plugs into a large language model, the kind of AI system that powers chatbots. The attackers can ask the AI to draft the next command, summarise what it found on a hacked machine, or sift through stolen files faster than a human operator could.

This is less a shiny new attack and more a productivity upgrade for criminals. The break-in method here, sneaking bad code into a trusted package repository, is a classic supply-chain attack. Think of it as tampering with an ingredient at the factory rather than poisoning one restaurant's dish.

What is genuinely new is that the operator on the other end has a co-pilot. Slower, less skilled attackers can now run campaigns that used to need an experienced hand.

Who is at risk?

Mostly developers and the companies that employ them. If a programmer installed one of the tainted packages on a Linux workstation or a build server, the attackers likely got a foothold there, and possibly deeper into whatever that machine could reach: source code, cloud keys, internal systems.

Ordinary users of finished apps are not the direct target. The risk to the public is second-hand: a poisoned developer machine can end up shipping poisoned software downstream, or leaking customer data pulled from company systems.

What should teams do now?

If your engineers pull packages from npm, and almost everyone does, check your install logs against the list Trend Micro published. Any Linux machine that installed one of the 14 packages should be treated as broken into. That means rebuilding it, rotating passwords and access tokens, and hunting for outbound connections to unfamiliar servers.

Beyond this specific incident, the fix is boring and effective: pin the exact versions of packages you depend on, review new dependencies before adding them, and run builds inside throwaway environments so a malicious install script cannot reach anything valuable.

npm supply-chain poisoning is not going away. If anything, an AI-assisted backend makes it cheaper to run. Expect more, not fewer.