[redshell]

August 27, 2026

• REDSHELL has changed its packaging again, now shipping the payload as math.mjs instead of .dat/.bin and surfacing in the npm package hydration-vli-ui (v1.0.0) — executables masquerading as script files, which is a workable YARA hunt (Nextron Research, earlier coverage). · Software Supply Chain

in When the Sandbox Isn't a Boundary

August 25, 2026

• REDSHELL resurfaces in three npm packages — hydration-dim-kit, hydration-dim-ui and hydration-ui-dim — carrying a newer ELF that keeps the same C2 and exfil infrastructure as the earlier campaign but uses a fresh beacon/campaign ID (sample on VirusTotal, via Nextron). · Malware & Supply Chain

in The Rogue Agent Staged an Apology, Then Pushed More Malware

July 30, 2026

• Malicious npm packages are delivering RATs on import. Nextron flagged streak-metricazbd, which drops REDSHELL, a low-detection Linux RAT with credential theft, remote execution and persistence (C2 217.60.77.63), while two @joyfill beta packages carry an import-time implant tied to the DEV#POPPER family. Nextron Research, The Hacker News · Threat Activity

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius