Malicious code in akamai-sensor (npm)

The akamai-sensor npm package was a typosquatting attack impersonating Akamai's legitimate sensor_data anti-bot SDK. The malicious package employed multiple obfuscation and evasion techniques to conceal its true functionality.

The package's index.js file contained a comment body encoded using invisible Unicode variation-selector characters (U+FE00-U+FE0F and U+E0100-U+E01EF). The sync-metrics.js module would read this comment, decode the hidden characters back to UTF-8 bytes, and execute the reconstructed JavaScript using new Function() with full require access. This execution was triggered whenever a consumer called the package's exported sensor() API.

Additionally, the package fetched a hardcoded Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics) on each sensor() call. It scanned event DESCRIPTION fields for base64-encoded URLs, appended /generate, and fetched JSON from the resulting endpoint—implementing a mutable command-and-control channel that the attacker could rotate by editing the calendar.

The attack combined vendor-name impersonation, invisible-Unicode payload concealment, dynamic code execution, and third-party dead-drop C2 infrastructure to compromise developers who trusted the Akamai brand.