Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed akamaijs-sensor
- Ecosystems
- Attack vectors
- Affected entities
- akamaijs-sensornpm package presenting as Akamai sensor generator
The akamaijs-sensor npm package contained two coupled malicious mechanisms designed to achieve remote code execution. The index.js file contained a comment filled with invisible Unicode variation-selector characters (U+FE00-FE0F and U+E0100-E01EF) that encoded arbitrary JavaScript bytes. The sync-metrics.js file decoded these hidden bytes via an unpack() routine and executed the resulting source through new Function('require', batch)(require), running attacker-authored code inside the consumer's Node process when the exported sensor() API was called.
Additionally, index.js fetched a hardcoded personal Google Calendar ICS feed from calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics. The package extracted URLs from event DESCRIPTION fields (accepting plain, base64-decoded, or HTML href forms), appended /generate, and GETted that endpoint, returning the JSON response to the sensor() caller. This calendar functioned as a dead-drop mechanism that the operator could rotate by editing calendar events, allowing the attacker to swap the live command-and-control endpoint at will without modifying the package itself.
The combination of invisible-Unicode-encoded code executed via new Function() and an attacker-rotatable C2 channel whose responses flowed back through the package's advertised API provided remote code execution against any installer with no legitimate purpose.
Indicators of compromise
- Packages
- akamaijs-sensor
- Domains
- calendar.google.com
Remediation
- Immediately uninstall akamaijs-sensor from all systems
- Audit npm package.json and lock files for any presence of akamaijs-sensor
- Review Node process logs for suspicious activity or unexpected outbound connections to calendar.google.com or unknown endpoints
- Regenerate any credentials or secrets that may have been exposed through compromised Node processes
- Implement package verification and integrity checks in the software supply chain
- Use npm audit and similar tools to detect malicious packages before installation
Sources
- GitHub Advisory GHSA-86x5-fp9h-hxg3 · GitHub Advisory Database
Cite this entry
"Malicious code in akamaijs-sensor (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-akamaijs-sensor-npm-1f4n84
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit