MAL-2026-13217
Dashboard / Malicious Package / MAL-2026-13217
MAL-2026-13217
Summary: Malicious code in akamai-sensorv2 (npm)
Details: Source: amazon-inspector (3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb) akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors (FE00-FE0F mapped to 0-15, E0100-E01EF mapped to 16-255). sync-metrics.js reads that comment, decodes the code points into a byte string, and passes the result to new Function("require", batch)(require), giving the decoded blob full access to require and therefore to fs, child_process, and network APIs on the installer's host. In parallel, config.json hardcodes a public Google Calendar ICS feed at https://calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics; fromCalendar() fetches this feed, scrapes DESCRIPTION fields (base64-decoding them), extracts an https URL, appends /generate, GETs it, JSON-parses the body, and returns it through the package's exported sensor() API. The Google Calendar entry is mutable by the attacker at any time, converting each caller of sensor() into an on-demand executor of whatever endpoint the calendar owner publishes. The steganographic encoding is a deliberate anti-review technique with no legitimate purpose. Package naming impersonates Akamai's sensor telemetry product but the code performs opaque payload execution and dead-drop C2 resolution.
Affected packages
Package
Name: akamai-sensorv2
Purl: pkg:npm/akamai-sensorv2
Affected ranges
Type: N/A
Events:
