Fourteen npm packages published under names like streak-metrics-math, kit-map-vim, and streak-map-cache look like small calendar and streak-tracking utilities. Developers pull them in without a second thought. Trend Micro’s threat research division, TrendAI, published findings on August 21, 2026 showing that importing any one of them silently launches a full command-and-control backdoor in the background of whatever project installed it, even if pulled in indirectly.
The exact list of the 14 compromised packages identified in the TrendAI research includes:
* `streak-metrics-math`
* `kit-map-vim`
* `streak-map-cache`
* `streak-map-kit`
* `map-streak-kit`
* `streak-cache-map`
* `streak-calc-metrics`
* `streak-calc-math`
* `streak-math-abz`
* `streak-metricsaz`
* `streak-math-metrics`
* `streak-metricazbd`
* `streak-metricsazb`
* `streak-kit-map`
Mechanics of transitive supply chain compromise execution
According to The Hacker News’ coverage of the TrendAI research, direct inclusion in a package.json is unnecessary for the malicious code to execute. A single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload. Developers can be several layers removed from choosing these packages and still end up running them simply because an installed dependency relies on them.
Once loaded, the package re-exports the legitimate date-handling functions it claims to provide so nothing visibly breaks, while separately launching the implant as a detached background process. There are no install hooks triggering the payload, bypassing a lot of automated dependency scanning. The malicious behavior starts only once the package’s code runs inside the application, not during installation itself.
Specific capabilities of the RedShell implant
The payload is RedShell, a Linux beacon connecting back to a command-and-control framework called RedC2 4.0, sold openly for $99.99 on a clearnet site by a seller using the handle “MarlboroMan,” first marketed on Hack Forums in June 2026 and explicitly advertised as built for evasion. It’s a cross-platform framework supporting Windows, Linux, and macOS targets. Once running, RedShell provides interactive shell access, system discovery, file operations, credential and SSH key harvesting from the compromised machine, in-memory execution of additional payloads without writing them to disk, and SOCKS5 proxying that lets the attacker route further traffic through the compromised server.
The framework’s other notable feature is Red Agent, an LLM-backed command execution layer that translates plain natural-language instructions into the specific beacon commands needed to carry them out. That detail matters less for what it does technically and more for what it signals: a toolkit that used to require significant operator skill to run effectively is now approachable by attackers with far less technical depth, reflecting an accessibility shift showing up across multiple unrelated malware families this year.
Vulnerability profiles for small teams and solo developers
Most coverage of npm supply chain attacks targets enterprise security teams monitoring thousands of dependencies through dedicated tooling. Small businesses running their own sites or freelance developers managing a handful of client projects often assume this coverage does not apply to them. Any Node.js-based application—whether a custom storefront, an admin dashboard, a build pipeline for a static site, or a small internal tool—pulls in dependencies the same way a large enterprise codebase does, usually with far less scrutiny of the dependency tree. A credential-harvesting backdoor running quietly on a server hosting a live ecommerce site is a more immediate business risk for a small operation than for a large one with dedicated incident response, simply because there is often nobody watching for it.
Context within the broader 2026 npm threat landscape
Fourteen packages is small compared to what the npm ecosystem has absorbed through 2026. Earlier campaigns this year compromised well over a hundred popular packages at once, including widely used libraries with millions of weekly downloads between them. One Microsoft-documented incident involved self-propagating malware that automatically modified package.json files and republished trojanized versions of packages using stolen maintainer credentials, without any human attacker involved in the spreading step. Against that backdrop, RedC2’s fourteen-package campaign is a smaller, more targeted operation. However, it shares the exact structural weakness every one of these incidents exploits: a developer’s trust in a package name is distinct from a verified guarantee about what that package’s code does, and vulnerability exists in that gap.
Scanning server environments for trojanized Node dependencies
Developers facing these threats can implement specific procedures to close exposure gaps.
* Search dependency outputs thoroughly by running `npm ls` or an equivalent dependency tree command against any Node project on a server and searching the full output—not just direct dependencies—for the fourteen named packages or anything with a suspiciously similar name pattern, keeping in mind that the campaign leans heavily on “streak-,” “map-,” and “metric-” name fragments in various combinations, deliberately close to legitimate-sounding utility names.
* Eliminate the habit of auto-updating dependencies to latest versions in production without review; pinning versions and reviewing changes before a bump, even for small utility packages, prevents this specific class of attack from reaching a production server silently.
* Monitor outbound traffic for anomalies by checking for unexplained outbound connections or unfamiliar background processes on any server running Node applications, since RedShell’s core behavior depends on maintaining a persistent connection back to its command infrastructure, a pattern that basic outbound traffic monitoring can catch.
Using lockfiles and CI audits as defensive controls
A committed lockfile, such as package-lock.json or the equivalent for whatever package manager is in use, pins the exact resolved version of every dependency in the tree, direct and transitive. This prevents a build from silently pulling in a newly published trojanized version of a package a project has depended on safely for months. That protection only holds if the lockfile is committed to version control and respected by the deployment process, rather than regenerated fresh on every deploy. For any project running an automated build or deploy pipeline, adding a simple audit step, such as `npm audit` at minimum, or a dedicated supply-chain scanning tool for anything handling customer data, catches a meaningful share of known-malicious packages before they reach a production server.
Server infrastructure requirements for runtime visibility
Securing modern web applications often requires evaluating underlying hosting environments. For instance, developers deploying applications that require raw command-line access to investigate background processes, inspect system activity, or configure custom outbound traffic monitoring can utilize a VPS with real server access rather than relying solely on restricted shared hosting accounts, which lack the necessary shell access and process visibility to audit unexpected network connections.
Summary of ongoing software supply chain risks
This is one campaign among a string of npm supply chain incidents that have hit the ecosystem through 2026, several involving hundreds of compromised packages and self-propagating malware capable of spreading through maintainer accounts automatically. Fourteen packages is a small campaign by that standard, yet it underscores a core vulnerability: dependency trees continue growing too deep for manual review to catch a transitive import. The gap between code appearing functional and servers remaining secure has widened for anyone building on top of the npm ecosystem without actively auditing underlying components.