What happened: security firm TrendAI found 14 npm packages, published under names disguised as calendar and date utility tools, that hid a Linux backdoor inside otherwise functional code. The backdoor runs automatically on import, without needing an install script, which evades the common defense of running npm install with scripts disabled. TrendAI links the payload to RedC2 4.0, a commercially marketed command and control framework that adds a natural language layer, letting an operator direct post exploitation actions with plain English instructions instead of manual commands.
Why it matters: this is the second software supply chain compromise CyberTech has covered this week, after this week’s disclosure of build time malware planted in Rust crates with 245 million downloads. Package registries remain a soft target precisely because most dependency security tooling checks install scripts and known malicious hashes, not the runtime behavior of code that executes only once imported. An AI layer on the operator side does not change the intrusion technique, but it lowers the skill floor for whoever runs the compromised packages once they land.
The original insight: TrendAI’s recommended defenses, auditing dependency graphs for the affected package names and watching for unexpected executable permissions being set on files inside node_modules, are detection steps any team can run today without new tooling. CyberTech has now covered a build time supply chain compromise in Rust’s ecosystem and a cascading breach that started with a single compromised scanner inside the same week, a pace that argues for treating dependency auditing as a standing control, not a one off response to each new registry incident.
Source: TrendAI
