The akamaijs-sensor npm package (version 3.0.0) masquerades as an Akamai sensor generator but embeds two malicious mechanisms. First, index.js contains a comment filled with invisible Unicode variation-selector characters encoding arbitrary JavaScript bytes. The sync-metrics.js file decodes this hidden code and executes it using new Function(), running attacker-authored code in the consumer's Node.js environment when the sensor() API is called. Second, index.js fetches a hardcoded Google Calendar ICS feed, extracting a URL from event descriptions that acts as a dynamic command-and-control endpoint. This endpoint can be rotated by the attacker via calendar event edits, allowing remote code execution with no legitimate purpose in the package.

This malicious package enables remote code execution in the context of the Node.js process that imports it, allowing an attacker to run arbitrary code on the affected system. The dynamic command-and-control mechanism via a Google Calendar feed allows the attacker to change payloads and commands without updating the package, increasing stealth and persistence.

No official patch or remediation is currently documented for this package. Users should immediately remove version 3.0.0 of akamaijs-sensor from their environments and avoid using this package. Verify dependencies and replace with trusted alternatives. Monitor for any unexpected network connections to Google Calendar URLs or suspicious behavior related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.