type: incident · created: 2026-08-24 · updated: 2026-08-24 · tags: · confidence: high · severity: high · affected_sectors: · au_impact: false
Trend Micro researchers documented 14 trojanised npm packages masquerading as calendar and streak-tracking utilities that deliver a Linux implant dubbed RedC2 4.0. Any import anywhere in a dependency graph, including transitive dependencies, executes the bundled payload, which marks itself executable and runs as a detached background process. The backdoor's command-and-control incorporates AI assistance, marking a further step in AI-operationalised offensive tooling following the previous week's Rust registry poisoning. Story date: 2026-08-21.