MAL-2026-13217

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamai-sensorv2/MAL-2026-13217.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13217
Published
2026-08-05T15:49:44Z
Modified
2026-08-05T16:49:56.896001781Z
Summary
Malicious code in akamai-sensorv2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb)

akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors (FE00-FE0F mapped to 0-15, E0100-E01EF mapped to 16-255). sync-metrics.js reads that comment, decodes the code points into a byte string, and passes the result to new Function("require", batch)(require), giving the decoded blob full access to require and therefore to fs, child_process, and network APIs on the installer's host. In parallel, config.json hardcodes a public Google Calendar ICS feed at https://calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics; fromCalendar() fetches this feed, scrapes DESCRIPTION fields (base64-decoding them), extracts an https URL, appends /generate, GETs it, JSON-parses the body, and returns it through the package's exported sensor() API. The Google Calendar entry is mutable by the attacker at any time, converting each caller of sensor() into an on-demand executor of whatever endpoint the calendar owner publishes. The steganographic encoding is a deliberate anti-review technique with no legitimate purpose. Package naming impersonates Akamai's sensor telemetry product but the code performs opaque payload execution and dead-drop C2 resolution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T16:13:46.81801958Z",
            "sha256": "3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb",
            "modified_time": "2026-08-05T15:49:44Z",
            "id": "IN-MAL-2026-015802",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / akamai-sensorv2

Package

Name
akamai-sensorv2
View open source insights on deps.dev
Purl
pkg:npm/akamai-sensorv2

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-wbK0CCJZo9yy3IW69ulOJfAjzEtujxUYEcuxIoo3MRdWWpYhTRu/UX2VoYB0qpvr4yLHKehfgjHZqLX9mhJGZw==",
                "sha1": "58772c450548c4a0fe66851c4e82e2784312fd33"
            },
            "filename": "akamai-sensorv2-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "427c50d775724e65fbaeef7d2b8dc106410934ac89515372b4cf4a2f61d3845b",
            "path": "sync-metrics.js",
            "tlsh": "b00189db26fb3161831350912adbd15a34dfec633606e0c1fbac92d0af62410477b5ad"
        },
        {
            "path": "config.json",
            "sha256": "49cbb19686bc11a4a0da323f7986f94429f3ae869d4cd488721d5248ab8e2905",
            "tlsh": "d9b092a2ef80f522476898a0a060a289f9261e2409affc4051977f0602c899222c50a8"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamai-sensorv2/MAL-2026-13217.json"