akamaijs-sensorv1

{"modified":"2026-08-15T17:41:47Z","published":"2026-08-15T17:41:47Z","schema_version":"1.7.4","id":"MAL-2026-14066","summary":"Malicious code in akamaijs-sensorv1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267)\nThe package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the hev4229@gmail.com calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.\n","affected":[{"package":{"ecosystem":"npm","name":"akamaijs-sensorv1"},"versions":["3.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"sync-metrics.js","sha256":"893e02a96aeedfc98224c8f20d2f0ae074bba54c7dc77fdb1fdf5d796e5fc1bb","tlsh":"f611abdb26fb3161431350901a9bd15a30dfec633606e0c1fb6c92d05f524504b6b5ad"},{"path":"index.js","sha256":"8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3","tlsh":"69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea"},{"path":"package.json","sha256":"6bdebe59459ea0698e2e9293aa5004bfca299a9f31adb7db829b0257f42e738e","tlsh":"f0d02b20a4218c2314c0eb505d89150292414d1b1c5434082b4b782c96ddc7700fe22c"}],"package_integrity":[{"filename":"akamaijs-sensorv1-3.0.0.tgz","hashes":{"sha1":"d03c07d1cc313891ff2bfad3e1d643f0f242a59d","sha512_sri":"sha512-G+pkTAitAB0vdJznOvAa74GXOtjY32r0jHkC6X/0DomknuVthFYxprOr0Jmu8qg7pA6ZxGp/M/P252V/QzjnQA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/akamaijs-sensorv1/v/3.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017972","import_time":"2026-08-15T18:08:48.463047037Z","modified_time":"2026-08-15T17:41:47Z","sha256":"9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267","source":"amazon-inspector","versions":["3.0.0"]}]}}