Trend Micro’s TrendAI found 14 trojanized npm packages that still work as advertised but also drop a Linux backdoor when imported. The packages masquerade as calendar and streak helpers, and a single import anywhere in the dependency graph is enough to launch the bundled payload.
The loader sits in the package entry file: it finds an embedded binary, marks it executable, and starts it in the background without an install hook or exported function. That makes ordinary dependency resolution the trigger, so a transitive package can hand a developer machine or Linux runtime shell access, credential theft, and attacker tasking through RedC2 4.0.
The exposure sits wherever Node.js code or npm dependencies are installed, built, or run. If a package can reach a workstation, build agent, or server process by import alone, the malicious path survives normal trust in the package’s visible behavior.