Malicious code in akamai-sensor (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178) Package published under a name impersonating Akamai's sensor_data anti-bot SDK. index.js contains a /*... */ comment whose body is encoded in invisible Unicode variation-selector and tag characters (U+FE00-U+FE0F and U+E0100-U+E01EF); sync-metrics.js reads index.js, extracts that comment, decodes the tag characters back to UTF-8 bytes, and passes the reconstructed string to new Function('require', batch)(require), executing hidden JavaScript with full require access. Execution is triggered when a consumer calls the package's exported sensor() API (index.js invokes require('./sync-metrics').touch()). index.js additionally fetches a hardcoded public Google Calendar ICS feed at calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics, scans event DESCRIPTION fields for a URL (base64-decoding the value), appends /generate, and fetches and parses JSON from that URL on each sensor() call - a dead-drop command-and-control channel whose target endpoint the operator can rotate at will by editing the calendar. The combination of vendor-name impersonation, invisible-Unicode payload concealment, dynamic code execution via new Function, and mutable third-party dead-drop C2 is a supply-chain attack against installers who trust the Akamai brand.
MAL-2026-14065
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-14065
akamai-sensor
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "akamai-sensor",
"purl": "pkg:npm/akamai-sensor",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamai-sensor/MAL-2026-14065.json",
"indicators": {
"evidence_files": [
{
"path": "sync-metrics.js",
"tlsh": "b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad",
"sha256": "427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b"
},
{
"path": "index.js",
"tlsh": "cba1ef517af3317b002351d4a357f0a495079e027585c8d0ea6c5bf52ed1e98c9e3dea",
"sha256": "88e66b03beaa43fd92af55081b5618964e836a7a8911f336d839f0e9194fd172"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "a046f0563eae197cc851ea6839463c2ba6e7bee1",
"sha512_sri": "sha512-JSZSFrDnMYs9Y13wSTuRExwhhio3TUlC+8Va+ZW6jYxlsUHoMKOtzsoiAdZb4gk45jWtQUZssTdU3wxvWDk9eQ=="
},
"filename": "akamai-sensor-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #11000 · Revision 1
- Added to Heist Feed
- Publisher date