One transitive import is enough: 14 npm packages that run a Linux backdoor with no install hook

The useful asymmetry in this indicator set is that the payload name moves and the loader does not. Trend Micro lists six filenames for the bundled binary (math-core.bin, math-calc.bin, calc-math.dat, calc-cache.bin, calc.bin, calc-mapping.bin) and two places it can sit, either dist/ or dist/internal/ ^[7][8]. The delivery path is identical across the set: dist/index.mjs, which re-exports the date helpers and starts the implant as the module loads ^[6]. Hunting on a filename covers part of the collection; hunting on an entry file that marks a bundled binary executable and launches it detached covers all of it ^[18][5].

Read the version strings next. Every listed package sits at 1.0.0, with one exception also published at 1.0.1, which comes to fifteen artifacts across fourteen names ^[2][14]. None of them is a hijacked update to an established library ^[16], so the reflexes built for that case have nothing to grip: no known-good earlier release to pin back to, no maintainer history in which a change looks out of place. The registry entry was hostile from its first publish.

The naming argues against blocklists as well. Twelve of the fourteen begin with streak-, and the rest reshuffle the same small token set of map, kit, cache, calc, math and metrics ^[15]. That is the output of a generator, and a list of fourteen strings is a snapshot of it. The control that still works against the next batch answers a different question: what is actually in the resolved tree, at every depth, and what in it has no reason to be there.

Which is where the report's own sentence does the work. No install hook function call is needed, and a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload, according to TrendAI ^[4]. The first host is rarely the point. The framework on the other end advertises host-to-host tunneling, multi-beacon operation and in-memory execution of BOFs and .NET assemblies ^[19], which is tooling for leaving the machine you landed on, and a Linux build agent that resolved one of these names without declaring it is interesting mostly for what it can reach.

The seller's lineage is not hidden: 2.0 in August 2025, 3.0 in January, and 4.0 advertised by a threat actor called MarlboroMan on Hack Forums in early June 2026, with the RedShell Linux beacon new in that version ^[10][11]. Two major releases inside ten months ^[17]. Red Offsec's terms of service prohibit unauthorized computer access and hacking without permission ^[13], which describes the seller's paperwork and nothing about the fourteen packages.