Malicious code in akamaijs-sensorv1 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267) The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the hev4229@gmail.com calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.
MAL-2026-14066
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-14066
akamaijs-sensorv1
Source reference: /affected/0/package/name
- Affected versions
- 3.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "akamaijs-sensorv1",
"purl": "pkg:npm/akamaijs-sensorv1",
"ecosystem": "npm"
},
"versions": [
"3.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensorv1/MAL-2026-14066.json",
"indicators": {
"evidence_files": [
{
"path": "sync-metrics.js",
"tlsh": "f611abdb26fb3161431350901a9bd15a30dfec633606e0c1fb6c92d05f524504b6b5ad",
"sha256": "893e02a96aeedfc98224c8f20d2f0ae074bba54c7dc77fdb1fdf5d796e5fc1bb"
},
{
"path": "index.js",
"tlsh": "69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea",
"sha256": "8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3"
},
{
"path": "package.json",
"tlsh": "f0d02b20a4218c2314c0eb505d89150292414d1b1c5434082b4b782c96ddc7700fe22c",
"sha256": "6bdebe59459ea0698e2e9293aa5004bfca299a9f31adb7db829b0257f42e738e"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "d03c07d1cc313891ff2bfad3e1d643f0f242a59d",
"sha512_sri": "sha512-G+pkTAitAB0vdJznOvAa74GXOtjY32r0jHkC6X/0DomknuVthFYxprOr0Jmu8qg7pA6ZxGp/M/P252V/QzjnQA=="
},
"filename": "akamaijs-sensorv1-3.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10951 · Revision 1
- Added to Heist Feed
- Publisher date