MAL-2026-12139

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamai-sensorv3/MAL-2026-12139.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12139
Published
2026-08-05T08:53:00Z
Modified
2026-08-05T10:05:47.678021132Z
Summary
Malicious code in akamai-sensorv3 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2)

The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor() triggers sync-metrics.touch(), which reads a comment in index.js whose body is not ASCII but a long run of Unicode variation-selector codepoints (U+FE00-FE0F, U+E0100-E01EF). An unpack() routine maps those invisible codepoints back to bytes, producing a JavaScript payload that is then executed via new Function('require', batch)(require) — giving the decoded code full require access to child_process, http, fs, os, and path. The decoded payload contacts a hardcoded C2 at http://souichidomain1870.xyz:5000/packageStarter. In parallel, fromCalendar() fetches a hardcoded public Google Calendar ICS feed owned by hev4229@gmail.com, scans DESCRIPTION lines for a URL (plain or base64-encoded), appends /generate, and returns JSON from that endpoint to callers — an attacker-mutable dead-drop for changing the runtime target without republishing the package. The invisible-character source comment, dynamic new Function evaluation, calendar-based endpoint resolution, and akamai-branded cover story together constitute a hidden remote-control implant, not a sensor-generation utility.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:53:00Z",
            "sha256": "d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2",
            "import_time": "2026-08-05T09:28:13.066297352Z",
            "id": "IN-MAL-2026-014455",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / akamai-sensorv3

Package

Name
akamai-sensorv3
View open source insights on deps.dev
Purl
pkg:npm/akamai-sensorv3

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "akamai-sensorv3-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-Rw8AGmk63bt3QHvZ4/s3F+60IjHnAQU0VsW9HLoSg+1doHlRUWiL/pf7Re03cc5EKAPGcDz7tZGCr/9nNfGoUQ==",
                "sha1": "6b2fb557375f438f29ec1b049e4c8cab28012dfe"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad",
            "sha256": "427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b",
            "path": "sync-metrics.js"
        },
        {
            "tlsh": "88a1ff557af33137002351d49347f0a495079e02b185c8d0eb6c5bf56ed2ea8c5e3dea",
            "sha256": "ea02dfc0f790e401c511320e542127747be6736ef360e47846a6a9cff75a9ef2",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamai-sensorv3/MAL-2026-12139.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]