{"answers":{"affected":"1 open source package ship an affected version, including akamai-sensorv2.","exploited":"There is no known exploitation of MAL-2026-13217 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13217 is a malicious package in akamai-sensorv2, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13217 is a malicious package: akamai-sensorv2 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13217/ (Markdown: https://insights.sbomify.com/MAL-2026-13217/index.md)","id":"MAL-2026-13217","markdown":"https://insights.sbomify.com/MAL-2026-13217/index.md","name":"MAL-2026-13217","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors (FE00-FE0F mapped to 0-15, E0100-E01EF mapped to 16-255). sync-metrics.js reads that comment, decodes the code points into a byte string, and passes the result to new Function(\"require\", batch)(require), giving the decoded blob full access to require and therefore to fs, child_process, and network APIs on the installer's host. In parallel, config.json hardcodes a public Google Calendar ICS feed at https://calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics; fromCalendar() fetches this feed, scrapes DESCRIPTION fields (base64-decoding them), extracts an https URL, appends /generate, GETs it, JSON-parses the body, and returns it through the package's exported sensor() API. The Google Calendar entry is mutable by the attacker at any time, converting each caller of sensor() into an on-demand executor of whatever endpoint the calendar owner publishes. The steganographic encoding is a deliberate anti-review technique with no legitimate purpose. Package naming impersonates Akamai's sensor telemetry product but the code performs opaque payload execution and dead-drop C2 resolution.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in akamai-sensorv2 (npm)","id":"MAL-2026-13217","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"akamai-sensorv2","purl":"pkg:npm/akamai-sensorv2","source":"MAL-2026-13217"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13217/"}