MAL-2026-14066

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensorv1/MAL-2026-14066.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14066
Aliases
  • GHSA-vf6f-mfc3-9548
Published
2026-08-15T17:41:47Z
Modified
2026-09-24T09:30:10Z
Summary
Malicious code in akamaijs-sensorv1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267)

The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the hev4229@gmail.com calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-017972",
            "import_time":  "2026-08-15T18:08:48.463047037Z",
            "modified_time":  "2026-08-15T17:41:47Z",
            "sha256":  "9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.0"
            ]
        },
        {
            "id":  "RLMA-2026-10680",
            "import_time":  "2026-09-24T09:21:32.024977732Z",
            "modified_time":  "2026-09-22T17:16:06Z",
            "sha256":  "505d9e5adcc0bdde21912263dd740b888f3eec3465a4c5f7b429d1e3101c3898",
            "source":  "reversing-labs",
            "versions":  [
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / akamaijs-sensorv1

Package

Name
akamaijs-sensorv1
View open source insights on deps.dev
Purl
pkg:npm/akamaijs-sensorv1

Affected ranges

Affected versions

3.*
3.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "sync-metrics.js",
            "sha256":  "893e02a96aeedfc98224c8f20d2f0ae074bba54c7dc77fdb1fdf5d796e5fc1bb",
            "tlsh":  "f611abdb26fb3161431350901a9bd15a30dfec633606e0c1fb6c92d05f524504b6b5ad"
        },
        {
            "path":  "index.js",
            "sha256":  "8927330811bc6a25c4476efb38e354ed8b17f0df7a9dbeb78409f98e2f03c9f3",
            "tlsh":  "69a1ee51baf3317b002351d4a357f0a495079e02b585c8d0ea6c5bf52fd2ea8c5e3dea"
        },
        {
            "path":  "package.json",
            "sha256":  "6bdebe59459ea0698e2e9293aa5004bfca299a9f31adb7db829b0257f42e738e",
            "tlsh":  "f0d02b20a4218c2314c0eb505d89150292414d1b1c5434082b4b782c96ddc7700fe22c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "akamaijs-sensorv1-3.0.0.tgz",
            "hashes":  {
                "sha1":  "d03c07d1cc313891ff2bfad3e1d643f0f242a59d",
                "sha512_sri":  "sha512-G+pkTAitAB0vdJznOvAa74GXOtjY32r0jHkC6X/0DomknuVthFYxprOr0Jmu8qg7pA6ZxGp/M/P252V/QzjnQA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/akamaijs-sensorv1/MAL-2026-14066.json"