Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of akamaijs-sensorv1 package
- Ecosystems
- Attack vectors
- Affected entities
- akamaijs-sensorv1npm package
The npm package akamaijs-sensorv1 was found to contain sophisticated malicious code disguised within what appears to be a legitimate Akamai Bot Manager sensor library. The package's index.js file contains hidden executable code encoded using invisible Unicode tag and variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF).
When a consumer calls the exported sensor() API, the sync-metrics.js module decodes these invisible characters back into executable bytes and runs them via dynamic evaluation (new Function('require', batch)(require)). This creates a hidden code execution sink that activates whenever the sensor function is invoked.
The malicious code additionally implements a calendar-based command-and-control mechanism. It fetches a hardcoded Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (supporting plain text, href, or base64-encoded formats), rewrites it to end in /generate, and issues a GET request to that URL. The response is returned as JSON to the caller. This design allows the attacker to change the network destination at any time by editing a calendar event, with no URL pinning, signing, or authentication.
The combination of invisible-character steganography, hidden eval, calendar-based dead-drop C2, and the Akamai-lure package name creates a covert remote-code execution and attacker-controlled redirector channel.
Indicators of compromise
- Packages
- akamaijs-sensorv1
- Domains
- calendar.google.com
Remediation
- Immediately remove akamaijs-sensorv1 from all dependencies and package-lock files
- Audit all projects that installed this package for signs of compromise or data exfiltration
- Review network logs for connections to calendar.google.com or any suspicious external URLs fetched during sensor() API calls
- Rotate any credentials or secrets that may have been exposed to systems running this package
- Update to a legitimate Akamai Bot Manager sensor library from official Akamai sources
- Implement package integrity verification and supply chain security scanning in your build pipeline
Sources
- GitHub Advisory GHSA-vf6f-mfc3-9548 · GitHub Advisory Database
Cite this entry
"Malicious code in akamaijs-sensorv1 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-akamaijs-sensorv1-npm-1xlnht
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit