Malicious code in akamaijs-sensorv1 (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267) The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment composed of invisible Unicode tag / variation-selector code points (U+FE00-U+FE0F and U+E0100-U+E01EF). sync-metrics.js reads the package's own index.js, decodes those invisible characters back into bytes, and executes the resulting string via new Function('require', batch)(require) — a hidden dynamic-eval sink that runs whenever a consumer invokes the exported sensor() API. sensor() additionally fetches a hardcoded public Google Calendar ICS feed (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics), parses the newest event's DESCRIPTION field for a URL (accepting plain text, href, or base64-encoded forms), rewrites it to end in /generate, issues a GET to that URL, and returns the response as JSON to the caller. The network destination the installer's process contacts is therefore controlled by whoever owns the [email protected] calendar and can be changed at any time by editing a calendar event, with no pinning, signing, or authentication of the retrieved URL. The invisible-character steganography, hidden eval, calendar-based dead-drop C2, and Akamai-lure package name together form a covert remote-code / attacker-controlled-redirector channel.

Source published

15 Aug 2026 17:41:47 UTC

Source modified

24 Sep 2026 09:30:10 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.