The npm package akamaijs-sensor version 3.0.0 contains malicious code that executes attacker-controlled JavaScript within the consumer's Node.js process. It hides arbitrary code inside Unicode variation-selector characters in a comment, which is decoded and executed dynamically. Additionally, it fetches a hardcoded Google Calendar ICS feed used as a dead-drop channel to retrieve attacker-controlled URLs, enabling remote code execution with no legitimate purpose.