MAL-2026-14066

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensorv1/MAL-2026-14066.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14066
Published
2026-08-15T17:41:47Z
Modified
2026-08-15T18:15:11.001506964Z
Summary
Malicious code in akamaijs-sensorv1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267)

The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the hev4229@gmail.com calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-15T18:08:48.463047037Z",
            "modified_time": "2026-08-15T17:41:47Z",
            "id": "IN-MAL-2026-017972",
            "sha256": "9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / akamaijs-sensorv1

Package

Name
akamaijs-sensorv1
View open source insights on deps.dev
Purl
pkg:npm/akamaijs-sensorv1

Affected ranges

Affected versions

3.*
3.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-G+pkTAitAB0vdJznOvAa74GXOtjY32r0jHkC6X/0DomknuVthFYxprOr0Jmu8qg7pA6ZxGp/M/P252V/QzjnQA==",
                "sha1": "d03c07d1cc313891ff2bfad3e1d643f0f242a59d"
            },
            "filename": "akamaijs-sensorv1-3.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "sync-metrics.js",
            "tlsh": "f611abdb26fb3161431350901a9bd15a30dfec633606e0c1fb6c92d05f524504b6b5ad",
            "sha256": "893e02a96aeedfc98224c8f20d2f0ae074bba54c7dc77fdb1fdf5d796e5fc1bb"
        },
        {
            "path": "index.js",
            "tlsh": "69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea",
            "sha256": "8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3"
        },
        {
            "path": "package.json",
            "tlsh": "f0d02b20a4218c2314c0eb505d89150292414d1b1c5434082b4b782c96ddc7700fe22c",
            "sha256": "6bdebe59459ea0698e2e9293aa5004bfca299a9f31adb7db829b0257f42e738e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensorv1/MAL-2026-14066.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]