akamai-sensorv3

{"modified":"2026-08-05T08:53:00Z","published":"2026-08-05T08:53:00Z","schema_version":"1.7.4","id":"MAL-2026-12139","summary":"Malicious code in akamai-sensorv3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2)\nThe package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor() triggers sync-metrics.touch(), which reads a comment in index.js whose body is not ASCII but a long run of Unicode variation-selector codepoints (U+FE00-FE0F, U+E0100-E01EF). An unpack() routine maps those invisible codepoints back to bytes, producing a JavaScript payload that is then executed via new Function('require', batch)(require) — giving the decoded code full require access to child_process, http, fs, os, and path. The decoded payload contacts a hardcoded C2 at http://souichidomain1870.xyz:5000/packageStarter. In parallel, fromCalendar() fetches a hardcoded public Google Calendar ICS feed owned by hev4229@gmail.com, scans DESCRIPTION lines for a URL (plain or base64-encoded), appends /generate, and returns JSON from that endpoint to callers — an attacker-mutable dead-drop for changing the runtime target without republishing the package. The invisible-character source comment, dynamic new Function evaluation, calendar-based endpoint resolution, and akamai-branded cover story together constitute a hidden remote-control implant, not a sensor-generation utility.\n","affected":[{"package":{"ecosystem":"npm","name":"akamai-sensorv3"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"sync-metrics.js","sha256":"427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b","tlsh":"b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad"},{"path":"index.js","sha256":"ea02dfc0f790e401c511320e542127747be6736ef360e47846a6a9cff75a9ef2","tlsh":"88a1ff557af33137002351d49347f0a495079e02b185c8d0eb6c5bf56ed2ea8c5e3dea"}],"package_integrity":[{"filename":"akamai-sensorv3-1.0.0.tgz","hashes":{"sha1":"6b2fb557375f438f29ec1b049e4c8cab28012dfe","sha512_sri":"sha512-Rw8AGmk63bt3QHvZ4/s3F+60IjHnAQU0VsW9HLoSg+1doHlRUWiL/pf7Re03cc5EKAPGcDz7tZGCr/9nNfGoUQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/akamai-sensorv3/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014455","import_time":"2026-08-05T09:28:13.066297352Z","modified_time":"2026-08-05T08:53:00Z","sha256":"d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2","source":"amazon-inspector","versions":["1.0.0"]}]}}