MAL-2026-12337

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensor/MAL-2026-12337.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12337
Published
2026-08-05T13:00:24Z
Modified
2026-08-15T18:15:11.004602206Z
Summary
Malicious code in akamaijs-sensor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe)

The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a /* */ comment filled with invisible Unicode variation-selector characters (U+FE00-FE0F and U+E0100-E01EF) that encode arbitrary JavaScript bytes. sync-metrics.js reads that comment, decodes the hidden bytes via an unpack() routine mapping the variation-selector ranges to nibbles, and executes the resulting source through new Function('require', batch)(require) — running attacker-authored code inside the consumer's Node process the first time the exported sensor() API is called. Separately, index.js fetches a hardcoded personal Google Calendar ICS feed at calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics, extracts a URL from event DESCRIPTION fields (accepting plain, base64-decoded, or HTML href forms), appends /generate, GETs that endpoint and returns its JSON to sensor()'s caller. The calendar functions as a dead-drop the operator rotates by editing calendar events, defeating static URL indicators and letting the operator swap the live endpoint at will. The combination — invisible-Unicode-encoded code executed via new Function() plus an attacker-rotatable C2 channel whose responses flow back through the package's advertised API — is remote code execution against the installer with no legitimate purpose in a sensor generator.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014844",
            "import_time": "2026-08-05T13:08:50.637058084Z",
            "sha256": "14a4955c82b04226b267bc55691b0b9c08770710a7038b58e75bfdd009d046fe",
            "modified_time": "2026-08-05T13:00:24Z",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017970",
            "import_time": "2026-08-15T18:08:48.206637771Z",
            "sha256": "dfd2d0c13b1caa83c5c30f575687c6fc6ba26599f062c8001e5743d24c201d44",
            "versions": [
                "2.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-15T17:41:29Z"
        }
    ]
}
References
Credits

Affected packages

npm / akamaijs-sensor

Package

Name
akamaijs-sensor
View open source insights on deps.dev
Purl
pkg:npm/akamaijs-sensor

Affected ranges

Affected versions

2.*
2.0.0
3.*
3.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "sync-metrics.js",
            "tlsh": "b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad",
            "sha256": "427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b"
        },
        {
            "path": "index.js",
            "tlsh": "69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea",
            "sha256": "8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3"
        }
    ],
    "package_integrity": [
        {
            "filename": "akamaijs-sensor-3.0.0.tgz",
            "hashes": {
                "sha1": "2b8be6879d9ccdf4d837760747b2f60e9a306ec8",
                "sha512_sri": "sha512-bDezv7Th9XK4OTTigEg9OXU+c9bDfzytOoMQhNyZ6bTKb9Br1oASd+u52Mzjo6HjfS/U++dc250OaClHtZfRzA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensor/MAL-2026-12337.json"