Date: 08/25/2026
Severity: High
Summary
Malicious npm packages are being used to hide a Linux backdoor inside calendar and streak-calculation tools. The packages provide legitimate date-related functions, making the malicious activity difficult to detect. The attack starts when an affected package is imported into an application. The loader makes a bundled Linux executable runnable and launches it silently in the background. Researchers identified the activity as a software supply chain attack delivering RedShell, a Linux implant. RedShell is associated with the RedC2 command-and-control (C2) framework.
Indicators of Compromise (IOC) List
Domains/URLs | litterbox.catbox.moe |
IP Address | 217.60.77.63 |
Hash | 4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466
|
Malicious NPM Packages | streak-metrics-math@1.0.0, streak-metrics-math@1.0.1 kit-map-vim@1.0.0, streak-map-cache@1.0.0, streak-map-kit@1.0.0, map-streak-kit@1.0.0 streak-cache-map@1.0.0, streak-calc-metrics@1.0.0, streak-calc-math@1.0.0, streak-math-abz@1.0.0 streak-metricsaz@1.0.0, streak-math-metrics@1.0.0, streak-metricazbd@1.0.0, streak-metricsazb@1.0.0, streak-kit-map@1.0.0 |
Filename / Filepath | %/dist/internal/calc-cache.bin %/dist/math-calc.bin %/dist/calc.bin %/dist/internal/calc-mapping.bin %/dist/math-core.bin %/dist/internal/calc-math.dat dist/index.mjs ~/.config/.rsvc |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "litterbox.catbox.moe" or url like "litterbox.catbox.moe" or siteurl like "litterbox.catbox.moe" |
Detection Query 2 : | dstipaddress IN ("217.60.77.63") or srcipaddress IN ("217.60.77.63") |
Detection Query 3 : | sha256hash IN ("4537B1189CE419F1A595CF47216C03F80E9170CE80DAD8D9227A1E52F9CB3466")
|
Detection Query 4 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "%/dist/internal/calc-cache.bin" or objectname like "%/dist/math-calc.bin" or objectname like "%/dist/calc.bin" or objectname like "%/dist/internal/calc-mapping.bin" or objectname like "%/dist/math-core.bin" or objectname like "%/dist/internal/calc-math.dat" or objectname like "dist/index.mjs" or objectname like "~/.config/.rsvc") |
Detection Query 5 : | technologygroup = "EDR" and (objectname like "%/dist/internal/calc-cache.bin" or objectname like "%/dist/math-calc.bin" or objectname like "%/dist/calc.bin" or objectname like "%/dist/internal/calc-mapping.bin" or objectname like "%/dist/math-core.bin" or objectname like "%/dist/internal/calc-math.dat" or objectname like "dist/index.mjs" or objectname like "~/.config/.rsvc") |
Reference:
https://cybersecuritynews.com/malicious-npm-packages/