The akamai-sensorv2 npm package version 1.0.0 embeds an executable payload inside a source comment using invisible Unicode variation selectors to encode bytes. The payload is decoded at runtime by sync-metrics.js and executed with full access to require, enabling access to filesystem, child processes, and network APIs. Concurrently, the package fetches a public Google Calendar ICS feed controlled by the attacker, extracts base64-encoded URLs from DESCRIPTION fields, and performs JSON requests to attacker endpoints. This design allows the attacker to remotely control the execution behavior dynamically. The steganographic encoding is an anti-review technique, and the package name impersonates a legitimate Akamai product, indicating malicious intent.

Users installing akamai-sensorv2 version 1.0.0 risk arbitrary code execution on their systems with full Node.js API access, including filesystem and network capabilities. The attacker can remotely update commands via the Google Calendar feed, effectively turning each installation into a remote-controlled agent. This can lead to system compromise, data exfiltration, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately uninstall akamai-sensorv2 version 1.0.0 and avoid using this package. Since the package is malicious by design, do not trust or run code from this source. Monitor for any usage of this package in your environment and remove it. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.