The akamai-sensorv1 npm package (version 1.0.0) embeds an executable payload inside a block comment in index.js using Unicode variation selectors. The sync-metrics.js script reads and decodes this hidden payload, executing it dynamically via a new Function call triggered by the sensor() function. Additionally, the package fetches a public Google Calendar ICS feed, parses DESCRIPTION fields for base64-encoded URLs, appends '/generate', and issues GET requests to these URLs. This technique forms a dead-drop command-and-control pattern, allowing the attacker to rotate next-hop endpoints by editing calendar events, thereby evading static URL blocklists. The package name is a lookalike of Akamai's sensor product but is unrelated to Akamai.

Any consumer calling the sensor() API in the akamai-sensorv1 package executes concealed malicious code, potentially allowing remote command execution controlled via a Google Calendar-based command-and-control infrastructure. This can lead to unauthorized code execution and control over the affected environment. The dead-drop C2 mechanism complicates detection and blocking by rotating endpoints dynamically.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove akamai-sensorv1 version 1.0.0 from their dependencies and avoid using this package. Verify dependencies for supply chain integrity and monitor for similar lookalike packages. Since this is a malicious package impersonating a legitimate product, rely on trusted sources and official vendor packages only.