MAL-2026-12139 Malicious code in akamai-sensorv3 (npm)

The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor() triggers sync-metrics.touch(), which reads a comment in index.js whose body is not ASCII but a long run of Unicode variation-selector codepoints (U+FE00-FE0F, U+E0100-E01EF). An unpack() routine maps those invisible codepoints back to bytes, producing a JavaScript payload that is then executed via new Function('require', batch)(require) — giving the decoded code full require access to child_process, http, fs, os, and path. The decoded payload contacts a hardcoded C2 at http://souichidomain1870.xyz:5000/packageStarter. In parallel, fromCalendar() fetches a hardcoded public Google Calendar ICS feed owned by [email protected], scans DESCRIPTION lines for a URL (plain or base64-encoded), appends /generate, and returns JSON from that endpoint to callers — an attacker-mutable dead-drop for changing the runtime target without republishing the package. The invisible-character source comment, dynamic new Function evaluation, calendar-based endpoint resolution, and akamai-branded cover story together constitute a hidden remote-control implant, not a sensor-generation utility.