The npm package akamai-sensorv1 version 1.0.0 contains malicious code hidden inside a block comment using Unicode variation selectors. This concealed payload is extracted and executed dynamically when the package's sensor() function is called. The package fetches a public Google Calendar ICS URL to retrieve commands via calendar event descriptions, implementing a dead-drop command-and-control mechanism that rotates endpoints to evade static URL blocking. The package name mimics Akamai's legitimate sensor product but is not affiliated with Akamai.