akamaijs-sensor

{"schema_version":"1.7.4","id":"MAL-2026-12337","published":"2026-08-05T13:00:24Z","modified":"2026-08-15T18:10:36.556820288Z","summary":"Malicious code in akamaijs-sensor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe)\nThe package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a /* */ comment filled with invisible Unicode variation-selector characters (U+FE00-FE0F and U+E0100-E01EF) that encode arbitrary JavaScript bytes. sync-metrics.js reads that comment, decodes the hidden bytes via an unpack() routine mapping the variation-selector ranges to nibbles, and executes the resulting source through new Function('require', batch)(require) — running attacker-authored code inside the consumer's Node process the first time the exported sensor() API is called. Separately, index.js fetches a hardcoded personal Google Calendar ICS feed at calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics, extracts a URL from event DESCRIPTION fields (accepting plain, base64-decoded, or HTML href forms), appends /generate, GETs that endpoint and returns its JSON to sensor()'s caller. The calendar functions as a dead-drop the operator rotates by editing calendar events, defeating static URL indicators and letting the operator swap the live endpoint at will. The combination — invisible-Unicode-encoded code executed via new Function() plus an attacker-rotatable C2 channel whose responses flow back through the package's advertised API — is remote code execution against the installer with no legitimate purpose in a sensor generator.\n","affected":[{"package":{"name":"akamaijs-sensor","ecosystem":"npm"},"versions":["3.0.0","2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"sync-metrics.js","sha256":"427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b","tlsh":"b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad"},{"path":"index.js","sha256":"8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3","tlsh":"69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea"}],"package_integrity":[{"filename":"akamaijs-sensor-3.0.0.tgz","hashes":{"sha1":"2b8be6879d9ccdf4d837760747b2f60e9a306ec8","sha512_sri":"sha512-bDezv7Th9XK4OTTigEg9OXU+c9bDfzytOoMQhNyZ6bTKb9Br1oASd+u52Mzjo6HjfS/U++dc250OaClHtZfRzA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/akamaijs-sensor/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/akamaijs-sensor/v/2.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014844","import_time":"2026-08-05T13:08:50.637058084Z","modified_time":"2026-08-05T13:00:24Z","sha256":"14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-017970","import_time":"2026-08-15T18:08:48.206637771Z","modified_time":"2026-08-15T17:41:29Z","sha256":"dfd2d0c13b1caa83c5c30f575687c6fc6ba26599f062c8001e5743d24c201d44","source":"amazon-inspector","versions":["2.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}