MAL-2026-12139
Dashboard / Malicious Package / MAL-2026-12139
MAL-2026-12139
Summary: Malicious code in akamai-sensorv3 (npm)
Details: Source: amazon-inspector (d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2) The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor() triggers sync-metrics.touch(), which reads a comment in index.js whose body is not ASCII but a long run of Unicode variation-selector codepoints (U+FE00-FE0F, U+E0100-E01EF). An unpack() routine maps those invisible codepoints back to bytes, producing a JavaScript payload that is then executed via new Function('require', batch)(require) — giving the decoded code full require access to child_process, http, fs, os, and path. The decoded payload contacts a hardcoded C2 at http://souichidomain1870.xyz:5000/packageStarter. In parallel, fromCalendar() fetches a hardcoded public Google Calendar ICS feed owned by [email protected], scans DESCRIPTION lines for a URL (plain or base64-encoded), appends /generate, and returns JSON from that endpoint to callers — an attacker-mutable dead-drop for changing the runtime target without republishing the package. The invisible-character source comment, dynamic new Function evaluation, calendar-based endpoint resolution, and akamai-branded cover story together constitute a hidden remote-control implant, not a sensor-generation utility.
Affected packages
Package
Name: akamai-sensorv3
Purl: pkg:npm/akamai-sensorv3
Affected ranges
Type: N/A
Events:
