The akamaijs-sensor package (version 3.0.0) masquerades as an Akamai sensor generator but includes two malicious mechanisms. First, index.js contains a comment filled with invisible Unicode variation-selector characters encoding arbitrary JavaScript bytes. The sync-metrics.js file decodes this hidden code and executes it dynamically via new Function(), running attacker-authored code in the user's Node.js environment when the sensor() API is called. Second, index.js fetches a hardcoded Google Calendar ICS feed, extracting URLs from event descriptions that serve as a dynamic command-and-control channel. This allows the attacker to rotate the live endpoint by editing calendar events, evading static detection. Together, these mechanisms enable remote code execution on the installer with no legitimate functionality.

This malicious package enables remote code execution within the Node.js process of any user who installs and calls the sensor() API. The attacker can execute arbitrary code, potentially leading to full system compromise, data theft, or further malware deployment. The use of a dynamic, attacker-controlled calendar-based command-and-control channel complicates detection and mitigation.

No official patch or remediation is currently available. Users should immediately remove the akamaijs-sensor package version 3.0.0 from their environments and avoid using this package. Investigate any systems where this package was installed for signs of compromise. Monitor for updates from the package maintainers or npm security advisories for any fixes or further guidance.